QMSR: FDA, industry experts discuss transition, inspection anxiety

BOSTON – Despite some early jitters, the medtech industry is coming around to the Quality Management System Regulation (QMSR), according to a top industry executive who spoke at The MedTech Conference on Monday.

Two US Food and Drug Administration (FDA) officials who spoke on the same panel sought to alleviate residual uncertainty about inspections under QMSR. They underscored that the agency isn’t going on a fishing expedition when it requests quality system documents during an inspection but rather is attempting to connect the dots on how a company manages risk.

The QMSR has been in effect since February 2026, replacing the previous Quality System Regulation (QSR) following a two-year transition period from when the final rule was published in 2024. FDA officials on the panel reminded attendees that a key objective of the new regulation is to harmonize US regulatory requirements with the international standard ISO 13485:2016.

Industry experience

Doug Reimer, a senior director of regulatory compliance at Johnson & Johnson, said the switch to QMSR was not as traumatic as the medtech industry initially feared. On the contrary, he said that it has learned a lot about the new regulation over the past eight months and is happy about how it has been implemented.

Reimer, who originally served in executive roles in the pharma industry, attributed the relatively painless transition to the preparation that FDA and industry put in before QMSR went into effect. He noted that many medtech companies were already following ISO 13485 and had European CE markings, so it wasn't completely uncharted territory for them.

"Everything's not perfectly harmonized, but the more we can do that, it helps our folks operate in the environment... so it's a little more seamless," said Reimer.

Since QMSR went into effect, Reimer said his company has role-played scenarios with various stakeholders, and one takeaway was to ensure they are reminded to use risk management and controls throughout the entire quality system. Furthermore, he said it was important to elevate the quality management responsibilities of people in management positions, so they are aware of their role in ensuring compliance with the new regulation.

Another important lesson that Reimer said he took away from the experience is to feel more comfortable with FDA getting access to more records. He noted that some companies were used to providing information on management review, audit reports and other such information when working with notified bodies in Europe, but he got nervous the first time FDA asked for audit reports.

"I've been through it a billion times with, whether it's TÜV or BSI or DECRA," said Reimer. "When FDA was looking at them, I had little butterflies for a couple of seconds, [but] it turned out okay.

"I think the key part is to make sure your organization has those controls connecting all the areas of the quality system and you can demonstrate that," he added. "I think one of the challenges that you have to be ready for is when FDA or even a notified body asks you how it feeds into your risk management, how it's connected."

Reimer said companies need to become more conversant about how various parts of their processes contribute to QMSR compliance.

Inspection anxiety

Keisha Thomas, associate director for compliance and quality at the Office of Product Evaluation and Quality (OPEQ) at FDA's Center for Devices and Regulatory Health (CDRH), said that some of the records that can be requested under QMSR that companies were nervous about were always accessible to FDA, though the agency didn’t typically access them directly during inspections. However, she said that if something concerning was found during an inspection, investigators could always request those records.

"I was actually a bit surprised when people were so put off by the fact that we were going to look at these records that you're already showing the other regulators that are working with ISO 13485, not to mention a lot of this material is also looked at in our [Medical Device Single Audit Program (MDSAP)] too," said Thomas. "It may be psychological to some extent."

Thomas said that the need to access such records under QMSR is in the spirit of transparency and harmonization, and the agency had no intention of causing undue angst. She noted that it follows a new philosophy where investigators look beyond the documents to ask how risk factors into their corporate operations and what parameters they are using in their risk-based decisions.

"What's important to understand is we don't come in and look at any records just for the sake of looking at them," said Thomas. "It's going to be in line with what we are looking at, what the inspection is unveiling in front of us, it'll align with the questions that we're asking, and then we'll ask for the documentation that supports that information.

"One of the areas that makes this a little bit harder is because of the type of questions we're asking," she added. "The lens in which we're asking the questions is a little different than what we've traditionally done."

Thomas said she understands how it may be jarring for companies when investigators now ask for such records, because they typically didn't maintain or organize them in a way that could be connected to their risk-based decisions under QMSR. However, she emphasized that their intention isn't just to ask for documents but to have conversations about their quality management.

"We haven't seen any gotchas; we're not really taking actions right now without access to those records," said Thomas. "I'm glad to hear that even though there were butterflies in this philosophical mind change, that it's not anything that we couldn't see.

"We're not seeing anything kind of heightened or alarming, now that we have access to those records," she added.

Karen Masley-Joseph, a senior advisor in the Office of Medical Device and Radiological Health Inspectorate at FDA's Office of Inspections and Investigations (OII), echoed the sentiment that QMSR is a byproduct of FDA's efforts to achieve greater harmonization. She noted that it's about patient-focused risk management throughout a product's lifecycle, and investigators don't have a prescribed list of documents to obtain; rather, requests are based on the questions they are trying to answer as part of their inspection.

"The best advice is, use those records to show the great decisions that you've made, use those records to show how effective you really have been in your system; that's the opportunity," said Masley-Joseph. "It can really play to an advantage for all of those companies."

Masley-Joseph said that since QMSR went into effect, the number one observation investigators are making is the lack of product realization, which has overtaken lack of corrective action as the most typical issue raised in Form 483s. She elaborated that they are observations, mostly regarding the lack of one or more risk management processes throughout product realization.

Thomas noted that it is difficult to discuss trends, as the agency hasn't issued many QMSR-related warning letters yet, since it is still too soon. She noted that the agency has issued Form 483s to companies since the regulation went into effect and is giving them a chance to come into compliance.

Reimer said that he was "brainwashed" for decades into fearing FDA investigators' document requests but acknowledged that they are helpful in demonstrating how a company's quality management system works. He also emphasized that whether they are document requests for management review, data review boards, internal audits, or supplier audits, they do tell investigators whether the quality system is functioning as it should. Ultimately, he said the quality management system is meant to be a self-detecting and self-correcting process to address potential problems before the product gets to patients.

"Over the years, there have been many times when an item came up in an external inspection... and some of our best defense was in an internal audit report or a supplier audit report, and we've used those to show we are aware we did do this and we fixed them, so they came to our benefit," said Reimer. "The depth and the detail in all those records... are much more involved and much more detailed than they were years ago because companies are seeing how important they are."