While the FDA’s Quality Management System Regulation (QMSR) deadline was February 2, 2026, some medical device manufacturers and companies across the industry may still be rushing to comply. While manufacturers who either incorrectly thought their current quality management systems already met the QMSR requirements or started late due to bandwidth or other constraints, it is not too late.

The reality is rushed implementations can lead to common pitfalls, including FDA findings, regulatory delays, and operational setbacks. Amid the turnaround to bring operations into compliance and close compliance gaps that could shut down production lines and derail market access strategies, companies can still avoid operational chaos. To avoid these setbacks, manufacturers must be knowledgeable and strategic to keep operations moving smoothly and bridge critical compliance gaps.

To avoid regulatory findings and update operations to meet the new requirements, there are critical areas where strategic moves, including risk-based approach expansion and strategic quality management system (QMS) transformation, can make the difference between smooth compliance and costly setbacks. Additionally, knowledge of ISO 13485 and the FDA’s new audit access powers will prove invaluable for moving quickly.

ISO 13485 Compliance Isn’t Enough

Through NSF’s work in gap analyses for medical device manufacturers, we are finding that many believe they meet the updated QMSR rules by having ISO 13485 certification. Unfortunately, this isn’t the case. Manufacturers must meet the new QMSR regulatory requirements, regardless of whether or not they hold certifications. This ensures that they are not exposed to gaps that could lead to challenges during their regulatory inspections.

Manufacturers need more than ISO 13485 because the framework differs between the two. While ISO 13485 provides a benchmark for quality management requirements, QMSR includes FDA-specific requirements that go beyond international standards. NSF has identified common themes where manufacturers are deficient, including inadequate risk management, inclusion and documentation, insufficient supplier qualification processes, and incomplete corrective and preventive action (CAPA) systems that meet ISO requirements but fall short of FDA expectations. Additionally, the critical FDA requirements for device labeling, traceability, and postmarket complaint handling and event reporting are beyond ISO 13485 and should be documented and active.

Enhanced documentation requirements, specific validation protocols, and unique reporting structures are required in QMSR, differing from what other certifications require. For example, ISO 13485 provides general guidance for software lifecycle processes, but QMSR requires alignment with specific validation documentation and the FDA’s software guidance documents. In this case, manufacturers operating only in compliance with their ISO 13485 processes might find that their software validation documentation lacks the granular detail FDA inspectors expect. This isn’t the only area where manufacturers will find differences in the framework.

In addition to potentially needing new processes to meet the QMSR requirements, manufacturers who lack the bandwidth to transition to the new requirements may face challenges. Some may need to internally expand or outsource additional support for their quality teams. This will help not only with manpower but also with expertise gaps that existing teams may not have. If possible, it is important to hire help that is specialized in FDA regulations, as QMSR is a very specific framework that will require niche expertise. Utilizing third-party support can significantly help companies that still need to transition their operations.

FDA’s Audit Access Powers

Historically, internal quality discussions were just that—internal discussions. With the QMSR update, the regulatory playing field has fundamentally changed. For the first time in FDA history, inspectors will have complete access to internal audits, supplier audits, and management reviews. With internal documents no longer off-limits, they can potentially be used in regulatory evaluations. With this significant change, companies need to treat every document as if it were open for the public to review since they are no longer confidential.

This expanded access requires manufacturers to completely rethink their documentation strategies. While manufacturers should already be acting in accordance with high-quality and moral operating standards, internal audits must be conducted with the understanding that FDA inspectors will scrutinize findings, corrective actions, and follow-up activities. Supplier audits need to meet FDA standards for thoroughness and documentation. Management reviews must demonstrate genuine engagement with team members and an objective evaluation of their practices.

Risk-Based Approach Expansion

Risk management plays a large role in manufacturing medical devices, and it is being impacted by the new QMSR. Traditionally, product safety considerations were the key to risk management; however, manufacturers need to spread risk-based decision-making across their entire process, including post-market surveillance.

Supply resilience is imperative for manufacturers to continue meeting market demand and is a key driver of risk-based management requirements. As we saw in 2020, changes in the supply chain can cause major disruptions. With QMSR, manufacturers must have strict surveillance of supplier management protocols and performance evaluation to help. They must now incorporate comprehensive risk matrices to help ensure operations continue and the supply chain stays resilient.

This type of operational mindset expands across every area of the business, including into software as a medical device (SaMD) components. Cybersecurity is a large risk, so identifying cybersecurity vulnerabilities will be imperative to protecting the product’s data across its lifecycle. Adjusting operations to adapt to a risk assessment mindset first helps to monitor potential threats, regulatory adjustments, and market needs.

Strategic QMS Transformation

QMSR represents far more than minor regulatory updates, as it demands a complete evaluation of quality management strategy that fundamentally reimagines how medical device companies approach compliance, operational excellence, and competitive positioning. Organizations must create QMS frameworks that align with ISO 13485 requirements while maintaining FDA-specific mandates, creating dual-compliance operations that optimize operational efficiency. To meet this requirement, manufacturers must evaluate their quality infrastructure to ensure that it has integrated management systems that connect design controls, risk management, corrective and preventive actions (CAPA) and post-market surveillance into a cohesive, data-driven operation. While ISO 13485 assesses whether your system is built correctly, QMSR tests whether it survives real-world failures, regulatory scrutiny, and legal accountability. 

To adopt the QMSR, manufacturers must utilize advanced quality metrics and analytics that provide insight into the QMS performance. This helps to proactively identify potential compliance gaps and operational inefficiencies. Companies that successfully navigate this transformation will discover that QMSR compliance becomes a strategic differentiator, positioning them as preferred partners for healthcare systems, regulatory bodies, and investors who increasingly prioritize robust quality management as an indicator of long-term viability and market leadership.

Future Operations

The QMSR is a big adjustment for the medical device manufacturing industry. While regulatory compliance can oftentimes be viewed as a necessary burden, for many, it can create a strategic competitive advantage. Organizations that embrace risk-based thinking throughout their operations and redesign their quality management systems for maximum effectiveness will be better positioned to navigate an increasingly complex regulatory landscape. Overall, the new requirements will also support them in delivering superior products to the market.

Manufacturers with a mindset of continuous improvement and seeking opportunities over challenges will prove more resilient amid changes like the QMSR implementation. Organizations that leverage a culture of opportunity will typically be more efficient and innovative in future quality management capabilities, which provide compliance and business expansion. The medical device industry will continue to evolve, and the QMSR is just one step for organizations to demonstrate their organizational maturity and operational excellence. By being agile, organizations can demonstrate their industry leadership and keep pace with regulatory evolution.

Sarah Moore directs medical device and IVD consulting for NSF. She has more than 25 years of professional experience, including with quality management systems, regulatory compliance (U.S. FDA, Health Canada, EU MDR/IVDR, U.S. EPA, BRAZIL ANVISA, CHINA NMPA), business mergers and acquisitions, continuous improvement, new product submission, product recall and remediation, risk management, process management, and people management. Both large and small, international and culturally diverse companies have offered her a wide range of business experience over her career. Sarah believes people are the most critical resource that drives business, and she focuses her efforts and attention on building relationships first. When strong trust is built, a healthy and profitable business always follows. In addition to her work in the medical device industry, Moore is passionate about nonprofit organizations in the St. Louis region focused on community betterment. She has volunteered time with several community organizations that bring greater access to housing, health care and education, and is always on the lookout for opportunities that contribute to improving human health, both locally and globally. Moore holds a Bachelor of Science in Chemical Engineering from the University of Missouri – Columbia.