Medical Device QMS: How to Build One for QMSR

What a medical device QMS is in 2026

A medical device quality management system (QMS) is the set of processes, responsibilities and records that ensure devices are designed, made and monitored to be safe and effective. Since February 2, 2026, the US and much of the world share one foundation: ISO 13485:2016.

FDA’s Quality Management System Regulation (QMSR) requires manufacturers to “Document a quality management system that complies with the applicable requirements of ISO 13485” (21 CFR 820.10(a), eCFR). The same standard underpins EU MDR expectations, MDSAP audits and most national regulations, so a well-built ISO 13485 QMS now serves nearly every major market.

The structure of an ISO 13485 QMS

ISO 13485 clause	Topic	Core processes and records
4	Quality management system	Quality manual, document control, record control, software validation (4.1.6), medical device file (4.2.3)
5	Management responsibility	Quality policy, objectives, management representative, management review
6	Resource management	Competence and training, infrastructure, work environment and contamination control
7	Product realization	Planning with risk management, customer requirements, design and development (7.3), purchasing (7.4), production and service provision (7.5), control of monitoring and measuring equipment (7.6)
8	Measurement, analysis and improvement	Feedback, complaint handling, regulatory reporting, internal audit, process and product monitoring, nonconforming product, data analysis, corrective and preventive action

What FDA adds on top of ISO 13485

The QMSR is not “ISO 13485 and nothing else.” FDA kept specific requirements where US law needs them (eCFR Part 820):

Links to other FDA regulations (§820.10(b)). Your QMS must cover unique device identification under Part 830, traceability under Part 821, reporting of complaints that meet Part 803 criteria, and handling of advisory notices under Part 806.
Design controls for specified devices (§820.10(c)). Manufacturers of Class II and III devices, and certain Class I devices including those automated with software, “must comply with the requirements in Design and Development, Clause 7.3” of ISO 13485.
Control of records (§820.35). “In addition to the requirements of Clause 4.2.5 in ISO 13485,” certain records must include specific information, notably complaint and servicing records, and UDI where applicable.
Labeling and packaging (§820.45). “In addition to the requirements of Clause 7.5.1 of ISO 13485,” manufacturers must document procedures describing labeling and packaging activities in detail, including inspection and release.
Definitions. Part 820 aligns terms with ISO 13485 and keeps FDA definitions where needed; for example, §820.3 refers to “the medical device file (MDF).”

FDA’s December 2025 QMSR webinar walks through these additions and the transition from the old QS regulation (FDA).

What an inspector will test

FDA’s revised compliance program, CP 7382.850, inspects the QMS through six areas: change control; design and development; management oversight; measurement, analysis and improvement; outsourcing and purchasing; and production and service provision (FDA). Early QMSR inspections show risk management as the top observation (RAPS). A QMS that looks complete on paper but does not connect risk to design, production and complaints will not hold up.

How to build a medical device QMS: eight steps

Define scope and role. Are you a specification developer, manufacturer, contract manufacturer, or all three? Which markets? Document any ISO 13485 exclusions and justify them, remembering that design controls cannot be excluded for most Class II and III devices.
Set up document and record control first. Every other process depends on approved, versioned documents and retrievable records. Decide early whether you will use an eQMS and validate it proportionate to risk, as ISO 13485 clause 4.1.6 and FDA’s Computer Software Assurance guidance describe (FDA).
Establish risk management. Write an ISO 14971 procedure and make risk an input to design, purchasing, production, complaints and CAPA, not a standalone file.
Implement design controls before design freeze. Retrofitting a design and development file is far harder than building it as you go.
Control suppliers. Classify suppliers by risk, qualify critical ones, and put quality agreements in place. Supplier audit reports are now open to FDA (FDA QMSR FAQ).
Build production and labeling controls. Process validation, device records, §820.45 labeling procedures and UDI.
Close the feedback loop. Complaint handling with MDR decisions, nonconformance, data analysis, CAPA and internal audits.
Run management review. Review the QMS with data, set objectives and resource needs, and keep records that will stand up to FDA review.

The QMS documentation hierarchy

Level	Document	Purpose	Example
1	Quality manual	Scope, exclusions, process map, policy	QM-001
2	Procedures (SOPs)	What is done, by whom, to which requirement	SOP-CAPA, SOP-Complaints
3	Work instructions	How a specific task is done	WI-Labeling-Line-2
4	Forms and templates	Consistent capture of records	CAPA form, design review template
5	Records	Evidence the process was followed	Complaint files, device history records
File	Medical device file (ISO 13485 clause 4.2.3)	Device-level documentation: description, labeling, specifications, procedures, servicing and installation	MDF-Device-A
File	Design and development file (clause 7.3.10)	Design history and evidence	DDF-Device-A

Keep procedures lean. A procedure should cite the ISO 13485 clause and any Part 820 section it fulfills, which makes gap assessments and inspections far easier.

Common QMS mistakes in the QMSR era

Old cross-references. Procedures still citing QSR sections such as §820.100 for CAPA instead of ISO 13485 clause 8.5.2.
Risk in a silo. A risk management file that is never updated from complaints, nonconformances or production data.
Paper-only management review. Minutes that list agenda items but no decisions, actions or data. FDA can now read them.
Unvalidated software. Spreadsheets, eQMS workflows and automation tools used for quality decisions without risk-based validation.
Generic supplier controls. The same controls for a packaging supplier and a sterilizer.
Incomplete complaint records. Missing the FDA-specific record content required by §820.35.

Medical device QMS checklist

Check your QMS against the requirements

Updating a QMS for QMSR means reading every procedure against ISO 13485 and Part 820. AI document assessment can do the first pass, flagging missing requirements and outdated references and citing the passage behind every finding, so your team can focus on fixing the gaps.

Run a sample regulatory document assessment on your CAPA or complaint procedure. AskDona shows the evidence; your quality team decides.

FAQ

What is a medical device QMS? The documented system of processes, responsibilities and records a manufacturer uses to ensure devices meet requirements. In the US it must comply with ISO 13485 under 21 CFR 820.10 (eCFR).

Is an ISO 13485 QMS enough for FDA? Not by itself. QMSR adds FDA-specific requirements for UDI, traceability, reporting, records and labeling.

When should a startup build its QMS? Before design controls are needed, typically once a design concept is selected and development begins in earnest. Document control and risk management should come first.

Do we need an eQMS? No regulation requires one, but electronic systems make records easier to retrieve. If you use one, validate it proportionate to risk.

References

All pages opened and checked by October 13, 2026.

Source	Type	Date	Used for
eCFR: 21 CFR Part 820	Regulation	Current	§§820.3, 820.10, 820.35, 820.45
FDA: QMSR webinar slides	Regulator	Dec 16, 2025	QMSR overview
FDA: QMSR FAQ	Regulator	2026	Records open to FDA
FDA: CP 7382.850	Regulator	Feb 2, 2026	Six QMS areas
FDA: CSA guidance	Regulator guidance	Feb 3, 2026	Software validation
RAPS: Top QMSR observations	Professional body	May 14, 2026	Risk management findings