GLOSSARY

What Is a Quality Management System (QMS)?

A quality management system (QMS) is the formalized set of policies, procedures, documentation requirements and processes a company uses to make sure its products are consistently safe and effective. For medical device companies, a QMS is not optional: FDA requires one under 21 CFR Part 820 — the Quality Management System Regulation (QMSR) — and most manufacturers build theirs against ISO 13485:2016, the international standard the QMSR now incorporates by reference.

The United States FDA requires every medical device company that markets products in the US to maintain a quality system, and that system is subject to inspection. Those requirements live in 21 CFR Part 820 — since 2 February 2026, the Quality Management System Regulation (QMSR), which replaced the older Quality System Regulation and incorporates ISO 13485:2016 by reference. Part 820 tells you what your policies and procedures have to cover. It does not tell you what they should say. That part is yours to write.

Quality system vs. Quality management system

A quality system is the organizational structure, responsibilities, procedures, processes, and resources for implementing quality management. You create these policies yourself, based on your business needs, the customer's needs, the perceived risk of your device, the specific requirements of your device, and in compliance with FDA regulations.

A quality management system is the set of tools that your company uses to manage the quality system, verifying and validating its ongoing effectiveness at satisfying the needs of your customer.

What does a medical device QMS include?

A quality management system is made up of the documented processes that govern how a device gets designed, made, monitored and improved. For a medical device company operating under QMSR and ISO 13485:2016, the core elements are:

Element	What it covers
Management responsibility	Quality policy, quality objectives, management review, and who is accountable for what
Document and record control	How controlled documents are created, approved, revised and retired, and how records are retained
Design controls	Design inputs, outputs, review, verification, validation, transfer and the design history file
Risk management	Risk analysis, evaluation and control across the product lifecycle, usually per ISO 14971
Purchasing and supplier controls	Supplier qualification, evaluation, monitoring and supplier-related nonconformances
Production and process controls	Manufacturing procedures, process validation, labelling and packaging controls
CAPA	How nonconformities are investigated, corrected and prevented from recurring
Complaint handling and post-market surveillance	How field feedback is captured, assessed for reportability and fed back into the system
Internal audits	Scheduled checks that the system works as documented, and that findings get closed
Training and competence	Who is trained on which procedures, and evidence that they are competent to perform them

None of these stands alone. A complaint can become a CAPA, which forces a design change, which updates the risk file and triggers a new training assignment. The quality of a QMS is largely a question of how reliably those connections hold.

QMSR and ISO 13485:2016 — which applies to you?

Which requirements apply depends on where you sell.

United States. FDA's Quality Management System Regulation (QMSR) took effect on 2 February 2026. It amended 21 CFR Part 820, removed the older Quality System Regulation, and incorporated ISO 13485:2016 by reference. A handful of FDA-specific requirements remain in Part 820 — including scope, definitions, control of records, and device labelling and packaging controls — while most operational requirements now point to the standard.

European Union. The Medical Device Regulation (MDR) applies, and manufacturers typically demonstrate conformity through an ISO 13485:2016-certified quality management system assessed by a notified body.

ISO 9001:2015 vs ISO 13485:2016. ISO 9001 is the general quality management standard used across industries and is built around customer satisfaction and continual improvement. ISO 13485 is the medical device–specific standard and is built around regulatory compliance, risk management and traceability. Device manufacturers build against ISO 13485.

The practical consequence for most companies selling into both markets is that one quality management system, built against ISO 13485:2016, can satisfy QMSR and support MDR conformity at the same time — provided the market-specific requirements are layered on top rather than run as a parallel system.

For a long time, a medical device company's quality system was a quality manager and a filing cabinet. Most now run it in software — an electronic quality management system (eQMS) that keeps controlled documents, CAPAs, audits and training records in one place and makes the connections between them traceable.

How QMS software replaced the filing cabinet

Can you imagine what a quality management system would look like before software solutions were available to manage the file folders full of documents produced by an effective QMS? As recently as ten years ago, medical device companies would keep whole filing cabinets full of documents - documents for design controls, documents for CAPA, photographs and engineer's drawings, policies for suppliers, manufacturing, and everything else. Greenlight Guru's QMS Software brings your quality management system online and makes it the single source of truth, leading to great organizational benefits.

CAPA & process improvement

The corrective and preventive action (CAPA) process is the heart of an effective QMS. This set of policies and procedures governs how an organization will assess feedback about non-conforming product and use it to correct sources of non-conformance in its product design, supply chain, and manufacturing processes. CAPA can generate a high volume of documentation, but Greenlight Guru's QMS Software helps you stay organized with assigned case numbers for each CAPA request and a streamlined approvals and review process.

Design controls and product development

The goal of an effective product development team is to create a product that meets identified user needs and is both safe and effective for its intended use. Medical device companies implement Design Controls, a crucial set of QMS processes, to ensure that product development follows the needs of the user without getting off track. Greenlight Guru helps by providing a single platform where your engineers can securely store and access all of the documentation produced in the product development process. Keeping your Design Controls organized is so important because the data generated in product development feeds into other documents later on - your 510k submission, device master record, and design history file, to name a few. With a software-based QMS, you'll never misplace or lose track of the most important documents related to your device.

Accountability and access

Greenlight Guru's QMS Software allows anyone at your organization to find and reference the policies most relevant to their role. By establishing and documenting controls for supplier management, production processes, labeling, packaging, handling, and even storage of your product, you maintain complete centralized control over the products that you create.

Your quality management system is the architecture you build to demonstrate that what you actually do complies with what the regulations require. FDA and ISO 13485:2016 set out which processes have to exist. Assigning the roles, writing the procedures and running them in a way that genuinely reduces risk — to patients and to the business — is yours.