The FDA’s Quality Management System Regulation (QMSR) took effect in February 2026, replacing the legacy Quality System Regulation (21 CFR 820) with a framework that incorporates ISO 13485:2016 by reference. For medical device companies, this is the most significant regulatory change in decades. It redefines how quality systems must be structured, documented, and maintained.
This article examines what the QMSR transition means in practice and how QAtrial v3.0.0 provides the tooling to implement it.
What QMSR Changes
Under the old QSR (21 CFR 820), the FDA maintained its own set of quality system requirements that overlapped with, but did not match, ISO 13485. Companies selling devices in both the US and EU had to maintain parallel documentation demonstrating compliance with both frameworks — an expensive and error-prone exercise.
QMSR Transition
QMSR eliminates this duplication. By incorporating ISO 13485 by reference, the FDA aligns US device quality system requirements with the international standard. Companies with an existing ISO 13485-certified quality system are well-positioned. Those that operated solely under the old QSR face a gap analysis and remediation exercise.
Key changes include:
- Design controls are now governed by ISO 13485 clause 7.3, replacing the prescriptive requirements of old 21 CFR 820.30.
- Risk management must follow ISO 14971, integrated throughout the product lifecycle rather than treated as a standalone activity.
- Documentation structure shifts from the QSR’s specific document requirements to ISO 13485’s more flexible but comprehensive documentation framework.
- Process validation requirements align with ISO 13485 clause 7.5.6, with emphasis on documented procedures and maintained records.
The transition deadline has passed, but the FDA has signaled a phased enforcement approach. Companies that can demonstrate active progress toward compliance have some runway, but the expectation is clear: ISO 13485 alignment is now mandatory for US market access.
Medical-Grade Software Development
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The EU MDR Medical Device QMS Pack
QAtrial includes a pre-configured EU MDR Medical Device QMS compliance starter pack that addresses both EU MDR and — by extension — QMSR requirements, since both frameworks are anchored in ISO 13485. The pack configures:
- Country: EU/Germany (EU MDR baseline with German regulatory overlay)
- Vertical: Medical Devices (QMSR/21 CFR 820, ISO 13485, IEC 62304, ISO 14971)
- Project Type: Quality System
- Modules (9): Audit Trail, Electronic Signatures, Risk Management, CAPA, Deviation Management, Supplier Management, Complaint Handling, Document Control, Training
The generated requirements and tests reference specific ISO 13485 clauses, ISO 14971 risk management requirements, and IEC 62304 software lifecycle clauses. This gives medical device QA teams a structured starting point rather than a blank spreadsheet.
The FDA QMSR Implementation Handbook: ISO 13485 Aligned Quality System Documentation, Management Review Records, CAPA Workflows, Design and Supplier Controls, and Inspection-Readiness Tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
ISO 13485 Gap Assessment
QAtrial’s AI co-pilot includes an ISO 13485 gap analysis that evaluates a project against the standard’s 27 clauses. The analysis uses a combination of keyword matching against existing requirements and AI-powered semantic analysis to categorize each clause:
- Clause 4 — Quality Management System: General requirements, documentation requirements, quality manual, control of documents, control of records.
- Clause 5 — Management Responsibility: Management commitment, customer focus, quality policy, planning, responsibility and authority, management review.
- Clause 6 — Resource Management: Provision of resources, human resources, infrastructure, work environment.
- Clause 7 — Product Realization: Planning, customer-related processes, design and development, purchasing, production and service provision, control of monitoring and measuring equipment.
- Clause 8 — Measurement, Analysis and Improvement: General, monitoring and measurement, control of nonconforming product, analysis of data, improvement.
For each clause, the gap analysis identifies which QAtrial requirements provide coverage, where partial coverage exists, and where no coverage is found. The AI suggests specific requirements that would close identified gaps, worded in the context of the company’s device type and regulatory environment.
This is not a one-time assessment. As the quality team adds requirements and closes gaps, the analysis can be re-run to track progress toward full ISO 13485 alignment — directly relevant to demonstrating QMSR compliance.
Medical-Grade Software Development
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Design Control: 7-Phase Kanban for Clause 7.3
ISO 13485 clause 7.3 governs design and development — the core of medical device quality. QAtrial implements design control as a seven-phase Kanban workflow:
- Planning — Define design inputs, resource allocation, responsibilities, and review/verification/validation milestones.
- Input — Capture and document design inputs: functional requirements, performance requirements, safety requirements, regulatory requirements, risk-based inputs from ISO 14971.
- Output — Document design outputs that meet input requirements, provide essential purchasing/production information, and specify acceptance criteria.
- Review — Formal design reviews at defined stages, with documented participants, results, and required actions.
- Verification — Confirm that design outputs meet design input requirements through testing, analysis, or comparison.
- Validation — Confirm that the final device meets user needs and intended use, including clinical evaluation where applicable.
- Transfer — Design transfer to production, including process validation and manufacturing documentation.
Each phase tracks its requirements, tests, evidence, and approvals. The traceability matrix links design inputs to outputs to verification results to validation records, creating the end-to-end traceability that both ISO 13485 and the FDA expect.
FDA QMSR transition compliance tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
DHF, DMR, and DHR Management
Medical device companies must maintain three core documentation sets:
- Design History File (DHF): The compilation of records that describes the design history of a finished device. QAtrial’s project structure, with its linked requirements, tests, evidence, and audit trail, serves as the DHF framework. Every design decision, review, and change is captured and traceable.
- Device Master Record (DMR): Specifications and procedures for manufacturing. QAtrial’s document control module manages DMR documents with version control, approval workflows, and controlled distribution.
- Device History Record (DHR): Production records for specific device batches. QAtrial’s evidence management and electronic signature capabilities support DHR documentation, with batch-specific test results linked to requirements and signed by authorized personnel.
The traceability between these documentation sets is maintained automatically. When a design requirement changes, linked test cases are flagged. When a test fails, CAPA records are initiated. When a CAPA is resolved, the evidence is attached and the resolution is signed. The audit trail captures the entire chain.
Validation Package: Ready for Device Company Validation
Medical device companies must validate the software tools used in their quality system. QAtrial ships with a complete validation package:
- Installation Qualification (IQ): 9 test steps verifying that QAtrial is correctly installed — server startup, database connectivity, frontend accessibility, user registration, login, file storage, theme switching, and language selection.
- Operational Qualification (OQ): 18 test steps verifying that QAtrial operates correctly — setup wizard, requirement CRUD, test CRUD, traceability linking, AI features, approval workflows, evidence attachment, CSV export/import, design control, ISO 13485 gap analysis, CAPA lifecycle, audit mode, and RBAC enforcement.
- Performance Qualification (PQ): A template for customer-specific validation in the production environment, with blanks for environment description, customer-specific test cases, and performance criteria.
- Compliance Statement: Detailed mapping of QAtrial features against 21 CFR Part 11 (15 sections), EU Annex 11 (17 sections), and GAMP 5 Category 4 classification.
- Traceability Matrix: 75 regulatory requirements mapped to QAtrial features and specific IQ/OQ/PQ test IDs.
For device companies operating under QMSR, this validation package provides the documented evidence that the quality management tool itself meets regulatory requirements — a prerequisite before the tool can be used for device quality activities.
Audit Mode: Share with Notified Body Auditors
EU MDR requires medical device companies to undergo regular audits by their Notified Body. QAtrial’s Audit Mode simplifies audit evidence sharing:
- The quality manager generates a time-limited read-only link (24 hours, 72 hours, or 7 days).
- The link is sent to the Notified Body auditor.
- The auditor opens the link in a browser — no login, no account, no VPN required.
- Seven tabs provide read-only access: Overview, Requirements, Tests, Traceability, Evidence, Audit Trail, and Signatures.
- The link expires automatically after the selected period.
For remote audits — increasingly common since 2020 — this capability eliminates the logistics of document package assembly and secure file transfer. The auditor sees the live state of the quality system, not a snapshot assembled under time pressure.
Getting Started with QMSR Compliance
git clone https://github.com/MeyerThorsten/QAtrial.git
cd QAtrial
cp .env.example .env
docker-compose upSelect the “EU MDR Medical Device QMS” compliance pack in the setup wizard. Despite the EU-focused name, the pack’s ISO 13485 foundation is directly applicable to QMSR compliance. Customize the generated requirements to reflect your specific device classification, intended use, and risk profile.
Run the ISO 13485 gap analysis to identify where additional requirements are needed. Import existing quality data from spreadsheets using the CSV import wizard. Begin building the traceable, auditable quality system that QMSR demands.
QAtrial v3.0.0 is available under the AGPL-3.0 license at https://github.com/MeyerThorsten/QAtrial.
