QSR and QMSR: Medical Device Quality System Guide

WORKER SAFETY: Quality System Regulation

The Quality System Regulation (QSR), codified at 21 CFR Part 820, was the FDA’s primary quality system standard for medical device manufacturers for over two decades. In February 2026, it was replaced by the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. Understanding the QSR’s structure, its core requirements, and how it evolved into the QMSR is foundational knowledge for quality professionals, manufacturing operators, and engineers working in medical device facilities.

1996

Year the QSR Was Issued

The Quality System Regulation (21 CFR Part 820) was finalized in 1996, replacing the Good Manufacturing Practice regulation that had governed medical device manufacturing since 1978. The QSR incorporated design controls for the first time, reflecting the recognition that most device problems originated in the design phase.

FDA, QMSR Overview

Feb 2026

QMSR Replaced the QSR

The Quality Management System Regulation (QMSR, 21 CFR Part 820) became effective February 2, 2026, replacing the QSR. The QMSR incorporates ISO 13485:2016 by reference, aligning FDA’s device quality requirements with the international standard used by most global regulatory frameworks.

FDA, QMSR Effective February 2026

Core Quality System Subsystems

The QSR and its successor QMSR organize quality system requirements into seven core subsystems: Management, Design Controls, Corrective and Preventive Action, Production and Process Controls, Document and Record Controls, Materials Controls, and Facilities and Equipment.

21 CFR Part 820, eCFR.gov

Why Every Worker Needs to Understand the Quality System Regulation

The QSR was not a framework for the quality department alone. Every person who performs a function that affects device quality is personally subject to its requirements. Manufacturing operators who complete batch records, engineers who design device components, technicians who perform equipment calibration, and supervisors who review production documentation all operate within the QSR framework. An FDA investigator visiting a device facility does not limit their questions to the quality manager. They interview operators, observe production, and compare what employees say to what the records show.

Understanding the QSR’s core requirements, the reasons they exist, and what compliance looks like in daily work is not optional knowledge for anyone in a device manufacturing environment. It is the foundation of safe, compliant production and the difference between a finding that generates a 483 observation and a finding that generates a Warning Letter.

What You Need to Know Before Your Next FDA Inspection

You will be interviewed. FDA investigators talk directly to the people performing the work. They will ask you to walk them through how you complete a procedure, what you do when something goes wrong, and who you notify. If your answer differs from the written SOP, both the procedure gap and the answer are inspection findings.

Your records are evidence. Every batch record, deviation report, training log, and calibration entry you complete is a regulated document. Corrections must be made with a single line through the error, the correct information, and your initials and date. Using correction fluid, crossing out information so it is unreadable, or completing a record from memory rather than in real time are all data integrity violations.

Not reporting a problem is not an option. Under QSR and QMSR, employees are expected to report deviations from procedures, equipment malfunctions, and product quality concerns through the formal quality system. Informally correcting a problem without documentation means the system cannot learn from it, cannot prevent recurrence, and cannot inform a regulatory report if the product was already distributed.

FDA, Quality Management System Regulation (QMSR)

The Seven Core QSR Subsystems and What They Mean for Your Work

1. Management Controls

Senior management must establish quality policy, conduct periodic management reviews of quality system performance, and ensure the resources and authority needed for quality functions are provided. For workers, this means management review findings and decisions should be visible in the quality system and that quality problems escalated upward receive a documented response.

21 CFR 820 Subpart B

2. Design Controls

Design controls govern the development of new devices and changes to existing ones. Engineers and R&D staff must document design inputs, outputs, verification testing, validation, and design reviews at each stage. Changes to a design must go through formal design change control. For production workers, design outputs define the specifications they must achieve; understanding that these specs have a documented origin matters for understanding why they cannot be informally changed.

21 CFR 820 Subpart C

3. CAPA (Corrective and Preventive Action)

The CAPA system is the quality system’s mechanism for identifying the root cause of problems and preventing their recurrence. Every production worker who identifies a nonconformance, receives a customer complaint, or observes a potential quality hazard is feeding the CAPA system. A CAPA that says the root cause was “operator error” without investigating why the operator made the error is not an adequate investigation and will be cited by FDA inspectors as such.

21 CFR 820 Subpart J

4. Production and Process Controls

Manufacturing processes must be defined in written procedures, validated where results cannot be fully verified by inspection, and executed by trained personnel. Environmental controls, contamination prevention, and process monitoring are all within scope. For operators, this means following written procedures exactly as written, documenting deviations rather than quietly correcting them, and understanding that process parameters have been validated and cannot be informally adjusted.

21 CFR 820 Subpart G

5. Document and Record Controls

Documents (SOPs, work instructions, specifications) must be controlled, current, and available at the point of use. Records (batch records, training logs, equipment logs) must be completed in real time, legibly, accurately, and with the required attributions. The Device Master Record (DMR) contains all device specifications; the Device History Record (DHR) documents actual production of each unit or lot and must be complete before any device is distributed.

21 CFR 820 Subpart M

6. Materials Controls

Components, raw materials, and labelling must be received, inspected against specifications, and controlled through their use in production. Incoming materials that have not been approved by the quality control unit may not be used in device production. Quarantine of rejected or uninspected materials must be enforced physically or through a documented system that prevents inadvertent use. Lot traceability from incoming component to distributed device is a core QSR requirement.

21 CFR 820 Subpart E

7. Facilities and Equipment

Buildings, equipment, and utilities used in device manufacturing must be adequate for their intended purpose, maintained in good repair, and cleaned and inspected according to written schedules. Equipment used to measure or test devices must be calibrated and qualified. Calibration records must show when calibration was performed, what standard was used, and the results. Equipment used after a calibration due date is a compliance violation regardless of whether the results are in specification.

21 CFR 820 Subpart D

From QSR to QMSR: What Changed in February 2026

The QMSR that replaced the QSR in February 2026 incorporates ISO 13485:2016 by reference. This means compliance with QMSR requires compliance with ISO 13485 as interpreted through FDA’s regulatory framework. The practical implications for workers in device manufacturing facilities:

What Did Not Change

The core quality system requirements are substantively the same. CAPA, design controls, document controls, production controls, materials management, and facilities requirements remain. Workers performing QSR-compliant processes are performing QMSR-compliant processes in the vast majority of cases.

What Changed Most

The QMSR is more outcome-oriented than the QSR, giving manufacturers flexibility in how they demonstrate compliance. It also formally aligns with ISO 13485 terminology, which may require procedure updates in facilities that used QSR-specific language. Facilities without prior ISO 13485 certification had the largest gap to close.

What You Should Verify

Confirm that the SOPs and work instructions you use have been reviewed and updated for QMSR alignment if your facility transitioned from QSR-only compliance. Check with your quality department to confirm which procedures were revised and whether additional training was required. Do not assume that a procedure written for QSR compliance is automatically QMSR-aligned without verification.

Worker Quality System Compliance Checklist

Daily QSR/QMSR Compliance Habits for Manufacturing Workers

☐ Only use the current approved version of the SOP or work instruction for your task : never from memory

☐ Complete all batch record entries at the time the activity is performed, not at end of shift

☐ Correct errors in records with a single line, initials, date, and brief reason : never with correction fluid

☐ Report any deviation from a written procedure to your supervisor and the quality unit, regardless of how minor it seems

☐ Never use materials, components, or equipment that are not marked as approved or released by quality

☐ Check calibration and maintenance status of equipment before use : do not use overdue equipment

☐ If you are asked about your work by an FDA inspector, answer accurately and specifically based on what you actually do

☐ If you do not know the answer to an inspector’s question, say so : do not guess

Key Takeaways

The QSR Was the Foundation; the QMSR Replaced It in February 2026

The Quality System Regulation governed medical device manufacturing from 1996 until February 2026 when the QMSR took effect. The QMSR incorporates ISO 13485:2016 by reference, aligning US requirements with the international standard. The core quality obligations are substantially preserved.

QSR/QMSR Applies to Every Person Whose Work Affects Device Quality

QSR and QMSR are not quality department frameworks. Every manufacturing operator, engineer, technician, and supervisor whose work affects device quality is subject to their requirements and may be interviewed by an FDA investigator about their understanding and daily practice.

CAPA Is How the System Learns and Improves

The CAPA system is the mechanism through which problems are identified, root causes investigated, and recurrence prevented. A CAPA system that only documents problems without investigating their causes or verifying that corrections worked is a system that will produce the same finding at the next inspection.

Records Must Be Completed in Real Time, Not Reconstructed

Contemporaneous documentation is a foundational QSR/QMSR requirement. Records completed from memory at the end of a shift, or reconstructed after the fact, are data integrity violations regardless of whether the underlying activity was performed correctly.

Frequently Asked Questions

What is the difference between the QSR and the QMSR?

The QSR (Quality System Regulation, 21 CFR Part 820) was FDA’s primary quality system standard for medical device manufacturers from 1996 until February 2026. The QMSR (Quality Management System Regulation) replaced it on February 2, 2026. The primary difference is that the QMSR incorporates ISO 13485:2016 by reference, aligning US requirements with the internationally recognised quality management system standard for medical devices. Core quality system requirements including design controls, CAPA, production controls, and document controls are preserved in the QMSR.

What is a Design History File (DHF) and who is responsible for it?

The Design History File is the complete record of the design and development history of a finished device. It must contain or reference all records that demonstrate the design was developed in accordance with the approved design plan and the design controls requirements of the QSR/QMSR. The DHF is typically owned and maintained by the engineering or R&D function, with quality oversight. FDA inspectors reviewing a new product or a design change will request the DHF to verify that design controls were followed throughout development.

What should I do if I make an error in a batch record?

Draw a single line through the incorrect entry so the original information remains legible. Write the correct information adjacent to the correction. Initial, date, and briefly note the reason for the correction. Never use correction fluid or any method that obscures the original entry. If the error involves a significant process step, notify your supervisor and the quality unit, as the deviation may require formal documentation. The goal is a record that accurately reflects what happened, including any corrections made.

What is the Device History Record (DHR) and what does it contain?

The Device History Record documents the actual production history of each manufactured device or lot. Under 21 CFR 820.184, the DHR must include or reference the production dates, the quantity manufactured, the quantity released for distribution, the acceptance records demonstrating the device was manufactured in accordance with the Device Master Record, the primary identification label and labelling used, and any unique device identification (UDI) or lot and serial numbers. No device may be distributed until the DHR is complete and has been reviewed and approved by the quality control unit.

What is process validation and when is it required?

Process validation demonstrates that a manufacturing process consistently produces a product meeting its predetermined specifications when operated within defined parameters. Under the QSR and QMSR, processes whose results cannot be fully verified by inspection of the finished product must be validated. This includes sterilisation, welding, injection moulding, and many other processes where the critical quality attribute cannot be measured without destroying the product. Operators running validated processes must follow the validated parameters exactly; any deviation must go through formal deviation management and may trigger revalidation assessment.

What happens during a QSR/QMSR FDA inspection?

FDA investigators conducting a QSR/QMSR inspection evaluate all seven quality system subsystems against the regulatory requirements. They will review documents, observe production, interview personnel, and examine records. They typically begin by requesting the CAPA log, device history records for recently distributed products, and complaint records. They will observe production operations and interview operators about their procedures and what they do when something goes wrong. Findings are documented on a Form 483 at the close of the inspection. Serious or recurring findings may result in a Warning Letter or other enforcement action.

What is the difference between a nonconformance and a CAPA?

A nonconformance is any failure to meet a specified requirement: a product that fails a test, a process step not performed as specified, a record completed incorrectly. CAPA (Corrective and Preventive Action) is the formal quality system process for investigating the root cause of a quality problem and implementing actions to prevent recurrence. Not every nonconformance requires a CAPA, but patterns of nonconformance, serious single events, and customer complaints typically do. The distinction matters because nonconformance disposition (rework, reject, use as-is with documented justification) addresses the immediate product, while CAPA addresses the system condition that produced the problem.

Government and Regulatory Sources

FDA. Quality Management System Regulation (QMSR): effective February 2, 2026, replacing the QSR; incorporates ISO 13485:2016 by reference.
21 CFR Part 820: Quality Management System Regulation for Medical Devices, eCFR.gov.
FDA. Design Controls: guidance on design and development requirements under 21 CFR 820 Subpart C.
ISO 13485:2016. Medical Devices: Quality Management Systems: the international standard incorporated by reference into the QMSR.