FDA Issues First Draft Guidance in the Countdown to QMSR

On January 31, 2024, FDA issued the final rule revising 21 C.F.R. Part 820, which, upon taking effect, will be referred to as the Quality Management System Regulation (QMSR) (see our prior blog post here).  The QMSR incorporates the international standard ISO 13485: 2016 Medical devices — Quality management systems — Requirements for regulatory purposes by reference and came with a two-year transition period and effective date of February 2, 2026.  The Agency has said little about its transition during the past two years, but on October 27, 2025, just months from implementation of the QMSR, FDA has issued its first draft guidance, Quality Management System Information for Certain Premarket Submission Reviews (Draft Guidance).

The Draft Guidance provides recommendations for QMSR information included in Premarket Approval (PMA) and humanitarian Device Exemption (HDE) application.  While of obvious importance to those working on PMAs and HDEs, the recommendations in the Draft Guidance also shed light on how FDA may be interpreting ISO 13485 and how it may review quality system information in future inspections.

There is a lot of overlap between the requirements of ISO 13485 and the current Quality System Regulation (QSR), which is being replaced by the QMSR.  One of the key differences between the current Quality System Regulation and ISO 13485 is the requirement in ISO 13485 to “apply a risk based approach to the control of the appropriate processes needed for the quality management system” ISO 13485: 2016, Subclause 4.1.2(b).  The Draft Guidance recommends submitters provide “a summary of the risk-based approach(es) used to control the processes that make up the organization’s QMS.” Draft Guidance at 7.  Thus, when updating the quality system for the QMSR, it will be important to not only ensure each procedure covers the specific requirements of ISO 13485, but also to ensure that the overarching risk-based approach used in developing the system is documented.

The Draft Guidance, when finalized, will supersede the current guidance, Quality System Information for Certain Premarket Application Reviews, issued February, 2003 (Current Guidance).  Despite more than 20 years, the overall content expected is not changing drastically.  The Draft Guidance presents the recommended information for a PMA or HDE in the order it is described in ISO 13485 and uses the terminology used in ISO 13485, which is not always the same as was used in the QSR.  A marketing application should include a full description of the documentation described in ISO 13485 for:

• Management responsibility, including responsibilities of top management;
• Resource management, including infrastructure requirements and requirements for the work environment and contamination control;
• Product realization, including development processes, design and development requirements, purchasing requirements, purchasing process requirements, purchasing information requirements, requirements for verification of purchased product, implementation of production and service provisions, and control of monitoring and measuring equipment; and
• Measurement, analysis, and improvement, including the processes for monitoring and measurement, control of nonconforming product, analysis of data, and identifying and implementing necessary changes.

For requirements of the QMSR that are not directly from ISO 13485, the Draft Guidance also provides recommendations for content in the marketing application.  These include requirements for unique device identification (UDI), traceability and medical device tracking, medical device reporting, reports for corrections and removals, control of records, and device labeling and package controls.  One item of note is that the Draft Guidance recommends the marketing submission include a “sampling of UDIs and Global Unique Device Identification Database (GUDID) records” whenever possible. Id. at 20. As a FDA Premarket Submission Number is required for obtaining a GUDID account and submitting data on the device, this will unlikely be available for original submissions.

One final point of interest in the Draft Guidance is the inclusion of a Guidance History table on the last page.  It includes a note that the “table was implemented, beginning October 2025, and previous guidance history may not be captured in totality”.  For the description of the revisions, it says to “See Notice of Availability for more information” and includes a link to the FDA guidance document webpage.  The Notice of Availability provides high level statements regarding the reason for the Draft Guidance, but does not provide information on the specific differences as compared to the Current Guidance.  Given the lack of any useful information, it is not clear why the table is being included.

Those wishing to submit comments on the Draft Guidance, should do so by January 16, 2026.

As the February 2026 effective date for the QMSR approaches, FDA’s release of the Draft Guidance offers long-awaited insight into how the Agency may operationalize its alignment with ISO 13485. While the core expectations for PMA and HDE submissions remain largely consistent with prior guidance, the shift in structure, terminology, and emphasis on a documented risk-based approach signals a meaningful evolution in FDA’s regulatory posture. Given this, all medical device manufacturers, not just those with planned PMAs or HDEs, should consider the Draft Guidance as any quality system updates are being made for compliance with the QMSR.