QMSR vs. QSR: What Actually Changed and What FDA Is Finding Five Months In

On February 2, 2026, FDA’s Quality Management System Regulation (QMSR) replaced the Quality System Regulation (QSR) that had governed device manufacturing practices since 1996. This wasn’t a rebranding — it’s a structural overhaul of how FDA defines, inspects, and enforces quality expectations for device manufacturers, built around harmonizing US requirements with the internationally recognized ISO 13485 standard. Five months of inspection data is now showing exactly where the practical impact is landing hardest.

The Structural Shift

The most consequential change is conceptual rather than clause-by-clause: QMSR incorporates ISO 13485 by reference as the quality system framework, rather than maintaining a US-specific, standalone regulatory text as the QSR did. This aligns the US with the quality system standard most manufacturers already use for international markets — reducing, in theory, the burden of maintaining two parallel quality frameworks for globally distributed devices.

But alignment with ISO 13485 doesn’t mean ISO 13485 certification alone guarantees QMSR compliance. FDA continues to conduct its own inspections independently, and no separate “QMSR certificate” is issued — meaning manufacturers need to demonstrate compliance through inspection readiness, not through a paper certification alone.

What Specifically Changed

QSIT retirement. FDA retired the Quality System Inspection Technique (QSIT) — the inspection framework that had guided device inspections for roughly 30 years — replacing it with QMSR-aligned, risk-based inspection approaches. Inspectors are no longer working through the familiar QSIT subsystem checklist; they’re evaluating whether risk-based thinking is genuinely embedded across the quality system.

Mandatory separation of CAPA workflows. Corrective and preventive actions, historically often managed as a single combined process, must now be handled as distinct workflows under QMSR — reflecting the different triggers, evidence requirements, and closure criteria for reactive correction versus proactive prevention.

Expanded risk-based thinking beyond design controls. Under the QSR, risk-based thinking was most explicitly required in design controls. QMSR extends that expectation across day-to-day operations — supplier management, software validation, production controls, change management, complaint handling, CAPA, and management review are all now expected to reflect documented, risk-informed decision-making, not just design-stage risk analysis.

“Feedback” vs. “Complaint” as a distinct conceptual split. QMSR introduces a clearer distinction between general feedback and formal complaints, changing how manufacturers need to structure intake, triage, and documentation processes to correctly route and respond to each category.

Expanded “top management” engagement expectations. QMSR’s incorporation of ISO 13485’s management responsibility clauses means the role of “top management” now implies genuine CEO or board-level endorsement of the quality system — not delegated sign-off. Executives are expected to be demonstrably engaged in QMS reviews and resource allocation decisions, not simply briefed on outcomes.

Deeper supplier and outsourcing controls. ISO 13485’s Clause 7.4 goes into considerably more detail than the prior QSR on supplier selection, monitoring, and re-assessment criteria. Given that FDA’s prior MDSAP inspection experience already showed suppliers as a frequent audit focus, manufacturers should expect this emphasis to continue and intensify under QMSR.

What Five Months of Inspection Data Actually Shows

CDRH reporting from the first several months following QMSR’s effective date identifies risk management as the single top observation category — ahead of outsourcing and purchasing controls, complaint handling and feedback, UDI tracking, and CAPA, which round out the top five. This ordering is telling: it’s not that manufacturers are failing at the mechanics of quality processes, but that FDA is finding gaps in the risk-based reasoning connecting those processes together.

CAPA deficiencies specifically have historically featured in over 60% of device-related Warning Letters — a pattern predating QMSR — and FDA is now cross-referencing pre-inspection intelligence (MDRs, consumer complaints, GUDID data) against manufacturers’ own risk files before inspections even begin. This means unaddressed post-market trends surface to FDA’s attention faster than they used to, and can trigger expanded inspection sampling once an inspector arrives with that intelligence in hand.

The clearest theme in the data: it’s no longer sufficient for a quality process to formally exist. FDA inspectors are now evaluating whether the design and execution of that process are demonstrably commensurate with the actual risk it’s meant to control — a noticeably higher bar than “does a documented procedure exist and get followed.”

What This Means for Quality Operating Models

The manufacturers navigating QMSR most successfully are not the ones responding with a documentation sprint or a one-time remediation project — they’re the ones rebuilding toward a quality operating model where inspection readiness emerges naturally from how the system is run day to day. Concretely, that looks like:

Internal audits that evaluate effectiveness, not just existence. An audit confirming a CAPA procedure exists and was followed is no longer sufficient; the audit needs to assess whether the CAPA actually closed the underlying risk.

Management reviews built around trend data. Complaint patterns, CAPA recurrence rates, supplier performance trends, and training effectiveness data need to feed directly into documented management decisions — not simply get reported and archived.

Traceable connections across records. A change order should visibly connect to a risk review; a CAPA should connect to documented evidence of closure; a training record should reflect genuine role relevance. FDA inspectors are increasingly testing this coherence across records, not just the individual records in isolation.

Executive engagement that’s demonstrable, not assumed. Given QMSR’s expanded “top management” expectations, manufacturers should be prepared to show — through meeting minutes, resource allocation decisions, and documented review participation — that executive leadership is genuinely engaged with the quality system, not simply informed after the fact.

QMSR’s core message, five months in, is consistent: risk-based thinking has to be visible and defensible throughout the quality system, not concentrated at design controls and assumed to propagate elsewhere. Manufacturers still operating with a QSR-era mental model — procedures that exist and get followed — are the ones most likely to be caught off guard by what FDA inspectors are now looking for.

This article reflects FDA’s QMSR, effective February 2, 2026, and publicly reported inspection trend data through mid-2026. It is intended for general regulatory and educational purposes and does not constitute regulatory or legal advice for a specific quality system.