QMSR and Design Controls

What the QMSR is

The Quality Management System Regulation (QMSR) is the US regulation on Current Good Manufacturing Practice (CGMP) for medical devices. It is codified in 21 CFR Part 820 and covers the design, manufacture, packaging, labeling, storage, installation, and servicing of finished devices intended for human use. It applies to devices manufactured in or imported into the United States, and therefore also to European manufacturers with access to the US market.

The FDA published the QMSR in the final rule “Medical Devices; Quality System Regulation Amendments” on February 2, 2024 (89 FR 7496). It has been effective since February 2, 2026 and replaces the Quality System (QS) Regulation in its 1996 version. The FDA rejected a phased introduction or a choice between the old and the new version: the QS Regulation applied until the effective date, and the QMSR has applied since then.

The FDA regards the requirements of ISO 13485 as substantially similar to those of the previous QS Regulation. The goal of the revision is international harmonization. Manufacturers should no longer have to build and audit their quality management system separately against two largely identical sets of requirements.

Incorporation of ISO 13485 by reference

The core of the QMSR is the incorporation of standards by reference. Under 21 CFR 820.7, ISO 13485:2016 in its third edition of March 1, 2016 and Section 3 of ISO 9000:2015 (terms and definitions) are part of the regulation. Exactly this edition is decisive. The FDA intends to evaluate future revisions of the standard and to amend the QMSR only through rulemaking.

Under 21 CFR 820.10(a), every manufacturer must document a quality management system that meets the applicable requirements of ISO 13485 and the remaining requirements of Part 820. The terms of the standard apply unless 820.3 provides otherwise. The definitions of the Federal Food, Drug, and Cosmetic Act take precedence. The US definitions of “device” and “labeling” therefore apply in place of the terms of the standard, and “organization” in the sense of the standard means the manufacturer. If a section of ISO 13485 conflicts with the statute or its implementing regulations, US law prevails (820.1(b)).

What became of the design controls

Under the QS Regulation, the design controls were set out in 21 CFR 820.30. The section divided development into planning, design input, design output, design review, design verification, design validation, design transfer, design changes, and the design history file. The FDA had introduced these requirements in 1996, after Congress gave it the authority to do so in 1990. The reason was that a considerable share of recalls was attributable to faulty product design.

With the QMSR, 820.30 has been removed, and Sections 820.20 to 820.30 are listed as “reserved.” Their place is taken by Section 7.3 “Design and development” of ISO 13485 with its subsections 7.3.1 to 7.3.10, to which 820.10(c) refers. According to the FDA, it covers the same stages: planning, design and development inputs, outputs, review, verification, validation, transfer to production, and changes.

In practice, much stays the same. The FDA expects a similar approach to design review and validation as under the QS Regulation. It names one difference explicitly: previously, every design review had to include an individual who does not have direct responsibility for the design stage being reviewed. The QMSR no longer contains this explicit requirement. Section 7.3.5 calls for representatives of the functions concerned and other specialists, and the manufacturer makes the selection.

Under Section 7.3.7, design and development validation includes clinical evaluations or performance evaluations in accordance with applicable regulatory requirements. For the US, the FDA refers to the existing regulations on clinical studies. Risk management is also anchored differently: the QS Regulation named risk analysis explicitly in 820.30(g), while the QMSR carries it through the entire system via the standard. ISO 14971 is not incorporated by reference. According to the FDA, any appropriate risk management process is acceptable.

Which devices design and development applies to

Which devices are subject to the design and development requirements has not changed. Under 820.10(c), Section 7.3 of ISO 13485 applies to all Class II and Class III devices (see FDA Device Classification) and to the following Class I devices:

• devices automated with computer software,
• tracheobronchial suction catheters,
• non-powdered surgeon’s gloves,
• protective restraints,
• manual radionuclide applicator systems,
• radionuclide teletherapy sources.

The FDA stresses that it thereby retains the scope of the former 820.30(a). It considers the exemption of most Class I devices consistent with ISO 13485, because the standard provides for exclusions by regulatory authorities. The manufacturer justifies the exclusion in its quality management system.

According to the FDA, the requirements do not apply to feasibility studies or proof of concept. They do apply before a clinical investigation under an Investigational Device Exemption (IDE). Manufacturers should document where research ends and development begins.

DHF, DMR, and DHR under the QMSR

The QS Regulation had its own record types: the Design History File (DHF) (German: Entwicklungshistorie), the Device Master Record (DMR) (German: Produktstammakte), the Device History Record (DHR) (German: Herstellungsnachweis), and the Quality System Record. The QMSR no longer uses these terms or the associated individual requirements. In the final rule, the FDA explains that ISO 13485 already largely requires the content, above all in Sections 4.2 and 7.

• DHF: Corresponding to the former DHF, Section 7.3.10 requires a design and development file. It contains or references all records that demonstrate that the design and development requirements are met, including the design and development plan and procedures.
• DMR: Product specifications, procedures for manufacturing, measurement, monitoring, and servicing, and installation requirements were previously kept in the DMR. They now belong in the medical device file under Section 4.2.3. The starting point of this file is the final design output from the design and development file.
• DHR: According to the FDA, many former contents of the DHR belong in the record for each device or batch under Section 7.5.1.

Existing design and development files do not need to be rewritten. According to the FDA at a town hall in January 2026, it expects neither retroactive references to ISO 13485 in files from before February 2, 2026 nor the removal of old terms such as Design History File. For devices that continue to be marketed after the effective date, it recommends a gap analysis. Changes over the life cycle are recorded under Section 7.3.9.

FDA-specific additional requirements

In addition to the standard, Part 820 contains some supplements that apply only in the United States:

• Link to other FDA regulations (820.10(b)): unique device identification (UDI) under Part 830, tracking under Part 821, reports to the FDA under Part 803, and corrections and removals under Part 806.
• Life-supporting devices (820.10(d)): For them, the traceability requirements for implantable devices under Section 7.5.9.2 apply in addition.
• Records (820.35): minimum content for records of complaints and service activities, and the recording of the UDI.
• Labeling and packaging (820.45): documented procedures, inspection for accuracy before release, for example of the UDI, expiration date, and storage and handling instructions, and measures against mix-ups.
• Access to audit reports: The FDA may now inspect reports on management reviews, internal audits, and supplier audits. The former exemption in 820.180(c) has been removed.

Under 820.10(e), violations of Part 820 render a device “adulterated” under US law. Since the effective date, inspections no longer follow the Quality System Inspection Technique (QSIT) but Compliance Program 7382.850 (as of October 2026).

Relevance for human factors and usability

The QMSR itself does not mention human factors. The connection arises through the design and development requirements of ISO 13485 and through the FDA human factors guidance, whose August 2026 version explicitly refers to the QMSR (as of October 2026).

• Design input: According to the guidance, when defining the design inputs, manufacturers must take into account the results of their risk management and usability requirements in line with the intended use. If the risk analysis shows that use errors could lead to serious harm, the manufacturer should apply human factors processes in line with the guidance.
• Verification: Verification confirms that the design output meets the design inputs. Because usability requirements are among the design inputs, their implementation must also be verified.
• Design validation: The FDA describes human factors validation testing as part of design validation. Even 820.30(g) required validation to ensure conformance with user needs and intended uses and to include testing under actual or simulated use conditions. CDRH, the FDA’s Center for Devices and Radiological Health, recommends considering human factors testing as part of a robust design control system.
• Documentation: As evidence for the design and development requirements, human factors results belong among the records that the design and development file contains or references. Which human factors information a submission, such as a 510(k) or a PMA application, should contain is described in the guidance “Content of Human Factors Information in Medical Device Marketing Submissions.” For submissions, the results are summarized in the HFE/UE report.

Frequently asked questions (FAQ)

Sources

• 21 CFR Part 820, Quality Management System Regulation (QMSR)
• ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes
• FDA Guidance: Applying Human Factors and Usability Engineering to Medical Devices
• FDA Guidance: Content of Human Factors Information in Medical Device Marketing Submissions
• Federal Register, Final Rule: Medical Devices; Quality System Regulation Amendments, 89 FR 7496, February 2, 2024
• FDA: Quality Management System Regulation, Frequently Asked Questions
• FDA CDRH Town Hall: Quality Management System Regulation, Risk and Design and Development, January 14, 2026 (Transcript)

Related terms

• Design input / design output
• Verification
• Validation
• Human factors validation testing
• FDA human factors guidance
• Risk management (ISO 14971)
• HFE/UE report (human factors report)
• Usability engineering process

← Back to the wiki overview