QMSR Town Hall Discusses Risk, Design, and Culture of Quality

In light of the fast-approaching compliance date of February 2, 2026, FDA convened a town hall discussing last-minute issues governing its priorities for the Quality Management System Regulation (QMSR), which incorporates by reference ISO 13485: 2016 Medical devices — Quality management systems — Requirements for regulatory purposes, and specifically the requirements related to risk management and design and development.  The town hall included an overview of the QMSR requirements around risk and design and development, followed by a moderated panel discussion where frequently asked questions were asked and answered.  FDA reinforced its emphasis on applying risk management to each aspect of the quality system, and of management building a culture of quality from the top.

FDA noted that risk management provides a framework for regulatory decision making in the design and development of medical devices, and also for other company processes, including planning, purchasing, production and service, monitoring and measuring equipment, monitoring and measuring, control of nonconforming product, and improvement.

Quality culture was not something specifically discussed in the context of the current Quality System Regulation (QSR), but has been discussed in various pilot programs, which we blogged on here and here.  FDA brought in this concept in the town hall stating that a culture of quality starts at the top, and reviewed one of their responses to comments to the proposed rule that states “FDA expects medical device manufacturers, led by individuals with executive responsibilities to embrace a culture of quality as a key component in ensuring the manufacture of safe and effective medical devices…” and “a culture of quality meets regulatory requirements through a set of behaviors, attitudes, activities, and processes.”  FDA emphasized that it is not just about what is documented, but how quality is embedded in decision making, accountability, and operations throughout the organization.

Specific to design and development, FDA noted that the design and development process should begin when research is ending, after feasibility and proof of concept have been demonstrated, and before any clinical evaluations are started.  As with design controls in the QSR, design and development under QMSR included stages and control for planning, input, output, review, verification, validation, transfer, and design changes.

For Class I devices exempt from design and development requirements as well as contract manufacturers or initial importers that do not perform design and development activities, FDA confirmed that risk management should still be used for other aspects of product realization, such as purchasing, production, or complaint handling.

With respect to design review, FDA confirmed that the ISO 13485 standard does not explicitly require an independent reviewer as was required in the QSR and that FDA expects appropriate personnel who can provide meaningful oversight of the design process to participate in design reviews.

FDA noted that there are no requirements in the QMSR or ISO 13485 to follow ISO 14971 Medical devices — Application of risk management to medical devices, to utilize any specific risk management tools, or to use quantitative descriptions of risk.  However, FDA noted that if not following ISO 14971, that an appropriately validated risk management process should be used to conduct risk management activities and that if data are available, it is useful to quantify risk of device.

For devices designed previously, FDA recognizes that the requirements of the QMSR are substantively similar to those of the QSR and noted that manufacturers do not need to retrospectively reference the QMSR in previous files.  FDA recommended that a gap analysis be performed to ensure requirements of ISO 13485 and the QMSR are met.

For postmarket surveillance, FDA recommended connecting analysis of processes and data, such as production data, nonconformities, complaints, adverse events, and customer feedback to the risk management process to ensure that emerging risk information is captured and evaluated in a timely manner.

FDA’s final thoughts included making sure manufacturers document risk management activities thoroughly and revisit them frequently, using risk management as a framework for sound decision making and using the design and development process to design quality, safety, and effectiveness into medical devices.

The QMSR town hall offered clarity on FDA’s expectations as industry transitions from the longstanding QSR to a framework aligned with ISO 13485. FDA’s emphasis on risk management reinforces its role as the backbone of sound regulatory decision‑making. Equally notable was FDA’s renewed focus on cultivating a culture of quality, signaling that compliance under the QMSR will extend beyond documentation.  However, in the final days before the QMSR is effective, FDA has still not released its new inspection process to provide clarity in just how inspectors will evaluate compliance under the QMSR.  If you have any questions about implementation of QMSR before the compliance deadline, please do not hesitate to call on us.