Medical Device Quality System (ISO 13485 / QMSR)
The medical device quality system is governed by ISO 13485 and, in the United States, 21 CFR Part 820 — now being harmonised into the Quality Management System Regulation (QMSR), which incorporates ISO 13485 by reference. Device quality is distinctively risk-management-led, from design controls through to software lifecycle and post-market surveillance.
ISO 13485 and the FDA QMSR
ISO 13485 is the international quality-management standard for medical devices — process-based, risk-aware, and the de facto global expectation. In the US, the FDA’s Quality System Regulation (21 CFR 820) historically stood apart, but the QMSR final rule harmonises the two by incorporating ISO 13485 by reference, taking effect in February 2026. For most manufacturers this converges two systems into one, with FDA-specific additions layered on top.
Design controls
The requirement that most distinguishes device quality from pharma is design controls: a formal, traceable process from design inputs (requirements) through design outputs, verification (did we build it right?), validation (did we build the right thing?), design review, and design transfer — all captured in the Design History File. Inadequate design controls are among the most common and consequential device inspection findings.
Risk management runs through everything (ISO 14971)
Device quality is risk-management-led end to end. ISO 14971 defines the application of risk management across the device lifecycle — risk analysis, evaluation, control, and post-production monitoring — and it is woven into design controls, production, and post-market surveillance rather than bolted on. For a device, "have you managed the risk?" is close to the whole question.
Software as a medical device (IEC 62304)
When software is part of, or is itself, a medical device, IEC 62304 defines the software development lifecycle — with a safety classification (A/B/C) that scales rigour to the harm a failure could cause. It connects to the wider quality system and to computer-system validation, and it is increasingly central as devices become software-defined.
CAPA and post-market
As with pharma, CAPA is where problems become prevention — and for devices it is consistently one of the most-cited inspection areas, alongside complaint handling and post-market surveillance. A device quality system is judged heavily on whether its feedback loops (complaints, adverse events, field data) actually drive corrective and preventive action.
Derived from the 4 standards that anchor this topic.
What is ISO 13485?
The international standard for a medical device quality management system — process-based and risk-aware, and the de facto global expectation for device manufacturers across design, production, and post-market activities.
What is the FDA QMSR?
The Quality Management System Regulation — the FDA final rule that harmonises 21 CFR Part 820 with ISO 13485 by incorporating the ISO standard by reference. It takes effect in February 2026, largely converging the US device quality requirements with the international standard.
What are design controls?
A formal, traceable design process — design inputs, outputs, verification, validation, design review, and design transfer, documented in the Design History File. Unique in emphasis to devices, and among the most commonly cited inspection findings.
How does ISO 14971 fit in?
ISO 14971 is the device risk-management standard, applied across the whole product lifecycle and woven through design controls, production, and post-market surveillance. Device quality is fundamentally risk-management-led, which is why 14971 sits at its centre.
Get the Weekly GxP Briefing
Curated regulatory intelligence — enforcement, recalls, guidance, and quality signals — in one practitioner-grade email each week. Free.