Life Science Outsourcing
pillar

QMSR Readiness: What Changes and What Auditors Want

L

LSO

The biggest QMSR risk for most OEMs isn't a misread clause. It's a supplier file that used to be invisible to FDA and now isn't.

The Quality Management System Regulation (QMSR) took effect February 2, 2026. The revised 21 CFR Part 820 now incorporates ISO 13485:2016 by reference, and FDA retired the legacy QSIT inspection approach in favor of Compliance Program 7382.850 (FDA — QMSR landing page). The rule change itself is settled. The operational consequences are still working their way through quality systems — and the early inspection data shows where the pressure is landing.

For a mid-to-large OEM running multiple contract manufacturers, the QMSR isn't just a documentation re-index. It's a forcing function on supplier oversight. Two of the three top early Form 483 observation areas — outsourcing/purchasing and risk management — sit squarely at the boundary between your QMS and your vendors' (RAPS — top observations from QMSR inspections). This article walks through what actually changed, what inspectors are citing, and how to use the readiness window to consolidate and harden vendor quality systems rather than just paper over the transition.

QMSR is a pillar for LSO's sterilization validation systems. Sterilization is a worked example throughout — an outsourced process whose output can't be fully verified by inspection, which makes it one of the clearest tests of whether your supplier controls hold up under QMSR.

What the QMSR Actually Changed — and What It Didn't

Start with the mechanism, because it drives everything downstream. The QMSR does not rewrite Part 820 clause by clause. It incorporates ISO 13485:2016 by reference and layers a small set of FDA-specific provisions on top (FDA — QMSR landing page). That structure has two practical consequences.

First, if your QMS was built around the legacy Quality System Regulation, most of the prescriptive subpart prose you indexed your procedures to is gone. The requirement didn't disappear — it now flows through the corresponding ISO 13485:2016 clause. Design controls live in Clause 7.3. Purchasing and supplier controls live in Clause 7.4. Process validation lives in Clause 7.5.6. CAPA lives in Clause 8.5.2 and 8.5.3. Work environment and contamination control live in Clause 6.4. If your SOPs still cite removed Part 820 subparts as the controlling requirement, they read as out of date to any auditor who knows the framework.

Second, the QMSR is not identical to ISO 13485:2016. FDA kept device-specific provisions that ISO doesn't cover, including 21 CFR 820.10 (QMS requirements), 820.35 (control of records), and 820.45 (device labeling and packaging controls) (AAMI — Global Harmonization of Medical Device Regulations). A certificate of conformance to ISO 13485 does not make you QMSR-compliant on its own, and it does not exempt you from FDA inspection (FDA — QMSR Final Rule FAQ). MDSAP participation also remains voluntary under the QMSR (FDA — QMSR Final Rule FAQ).

The documentation constructs you've used for years get redistributed rather than retired. The legacy DHF, DMR, and DHR map into ISO 13485:2016-aligned records — notably the Medical Device File — and the transition introduces more than 100 terminology updates across the total product lifecycle, plus a shift toward explicit top management accountability (AAMI — Navigating the QSR to QMSR Terminology Transition). None of that changes what a record has to prove. It changes where the record lives and what you call it.

A December 4, 2025 Federal Register notice issued technical amendments updating cross-references — including former §§820.180 and 820.198 — across numerous Title 21 device-classification parts to conform with the QMSR transition (Federal Register — QMSR Technical Amendments). These are conforming edits, not new obligations, but they're worth flagging to your regulatory team so internal references stay accurate.

What this means for an OEM with legacy ISO 13485 systems

If you already maintain an ISO 13485:2016-certified QMS, the conceptual lift is smaller — but don't mistake a certificate for readiness. The FDA-specific provisions in 820.10, 820.35, and 820.45 are where ISO-certified firms most often have gaps, because those are exactly the areas ISO doesn't enumerate the way FDA does. Walk those three sections deliberately before assuming your existing system covers them.

Where Early QMSR Inspection Observations Are Clustering

The most useful signal available right now is what inspectors are actually citing. At a recent FDLI conference, FDA CDRH's Keisha Thomas reported that early QMSR Form 483 observations cluster around three areas: risk management, outsourcing and purchasing, and complaint handling (RAPS — top observations from QMSR inspections).

Treat that as a directional early read, not a published frequency dataset — it reflects preliminary inspection trends reported at a single conference. But the pattern is coherent, and two of the three areas are supplier-facing. That's the part most OEM readiness plans underweight.

The record exemption that's gone

Here is the change that catches established manufacturers off guard. Under the legacy framework, internal audit reports and certain supplier records were shielded from routine FDA review. That exemption is gone. Under the QMSR, internal audit and supplier records that inspectors previously couldn't pull are now reviewable and can drive 483 observations (RAPS — FDA draft guidance on QMSR information for premarket submissions).

Think through what that means in practice. Your supplier audit reports, your supplier corrective-action correspondence, your quality-agreement performance records — files that used to stay inside your four walls — are now fair game during an inspection. If your supplier files document open findings without closure evidence, or if your supplier scorecards show a pattern of recurring issues you never escalated, an inspector can see all of it.

This is why outsourcing and purchasing showing up as a top early finding isn't a coincidence. The records that demonstrate supplier control are now visible, and many manufacturers built those records assuming they never would be.

Supplier and Outsourced-Process Controls Under the QMSR

Purchasing and supplier controls under the QMSR are governed by ISO 13485:2016 Clause 7.4. The clause requires you to evaluate, select, and monitor suppliers; establish purchasing information; and verify purchased product (ISO 13485:2016 Clause 7.4). That's the obligation. The harder question is how you discharge it across multiple contract manufacturers without drowning your quality team in redundant systems.

For outsourced processes specifically, the standard adds a sharper requirement. Process validation under ISO 13485:2016 Clause 7.5.6 applies to any production or service process whose output cannot be fully verified by subsequent inspection or test (ISO 13485:2016 Clause 7.5.6). Sterilization is the textbook case. You cannot inspect a finished lot and confirm it was sterilized correctly without destroying it; you rely on a validated process. The QMSR pulls that validation requirement through Clause 7.5.6, and when sterilization is outsourced, the validation evidence and the supplier's control of that process both fall inside your supplier oversight.

Why sterilization is the stress test for supplier controls

Walk the chain. You select a sterilization provider (Clause 7.4). The provider runs a process you can't verify by inspection, so it must be validated (Clause 7.5.6). The validation records, the routine release data, the requalification history — all of it now sits in supplier files an FDA inspector can review (RAPS — FDA draft guidance on QMSR information).

That means three things have to line up:

  • Selection and evaluation evidence — documented qualification of the sterilization provider against defined criteria, not a handshake and a certificate on file.
  • Validated-process evidence — current validation and requalification records for the specific cycle, device family, and load configuration you actually ship.
  • Ongoing monitoring — release data, deviations, and how you handle them, captured in a way that closes the loop rather than leaving open findings dangling.

If any of those three is thin, sterilization is where it shows. And because the validation requirement is non-negotiable for a process you can't inspect, there's no graceful way to argue around a gap.

Packaging and labeling controls didn't fully harmonize

Don't lose 820.45 in the shuffle. Device labeling and packaging controls are among the FDA-specific provisions the QMSR retained beyond ISO 13485:2016 (AAMI — Global Harmonization of Medical Device Regulations). For OEMs that outsource packaging or sterile-barrier work, that's a second outsourced-process area where supplier controls and FDA-specific requirements overlap. If you validate packaging to ISO 11607 through a contract partner, the same selection-validation-monitoring discipline applies, and the 820.45 retention means FDA still has device-specific packaging expectations the ISO clause alone doesn't fully cover.

Using the Transition to Consolidate Vendor Quality Systems

Here's the strategic opening most of the coverage misses. The QMSR transition is a reason to revisit your whole supplier base at once — and for OEMs already under cost or risk pressure to consolidate contract manufacturers, the timing is useful rather than burdensome.

Consider the math on managing supplier controls across many vendors. Every contract manufacturer you hold a quality agreement with is a separate stream of: selection evidence, audit records, corrective-action correspondence, validated-process documentation, and monitoring data. Under the legacy framework, much of that stayed shielded. Under the QMSR, every stream is now inspectable, which means every stream now has to hold up to FDA scrutiny — not just your internal standard.

More vendors means more streams that have to be defensible. Consolidating the number of contract manufacturers you rely on reduces the number of supplier files an inspector can pull and the number of quality systems your team has to keep audit-ready. That's not a marketing argument; it's an arithmetic one. Fewer suppliers, fewer Clause 7.4 relationships to evidence, fewer places a thin file can surface as a 483.

What to look for when you consolidate

If you're using the readiness window to reduce your vendor count, evaluate candidate partners on the dimensions the QMSR now makes visible:

  • QMS maturity that maps cleanly to ISO 13485:2016. A partner whose system is already indexed to the current clauses gives you supplier records that read correctly to an FDA inspector without translation.
  • Validated-process depth for outsourced operations. For sterilization, packaging, and any process you can't verify by inspection, the partner should own current validation and requalification evidence under Clause 7.5.6 — and be able to produce it.
  • Record transparency. Because supplier and audit records are now reviewable, you want a partner whose records you'd be comfortable showing an inspector, not one whose files you'd rather keep shielded.
  • Breadth under one roof. Consolidating assembly, packaging validation, and sterilization validation with fewer partners cuts handoffs — and every handoff between suppliers is another seam where a record gap or a process-control deviation can hide.

A practical clause-mapping aid exists here: AAMI TIR102:2019 provides a clause-level mapping between the legacy QSR and ISO 13485, referenced by FDA in the QMSR transition (FDA — QMSR Final Rule FAQ). Use it to re-index your own procedures and to check whether a candidate partner's documentation is genuinely aligned to the current clauses or just relabeled. Note that TIR102:2019 is a mapping tool, not a regulatory requirement — it tells you where things moved, not what to do once you get there.

A Readiness Checklist for the Transition Window

Pull the threads together into a sequence you can act on. None of this is exotic; the value is in doing it deliberately while the window is open.

The firms reported to face the steepest transition are smaller, U.S.-focused manufacturers and combination-product makers without mature ISO 13485 systems. For established OEMs, the lift is more about supplier discipline and record transparency than about building a QMS from scratch. But the supplier-facing observations cut across firm size — outsourcing and purchasing being a top early finding means even mature manufacturers have exposure where their controls meet their vendors'.

The Bottom Line

The QMSR settled the rule. What it didn't settle — and what the early 483 data is now surfacing — is whether your supplier controls hold up when the records that used to be invisible are sitting on an inspector's table. Outsourcing, purchasing, and risk management lead the early observations because that's where the transparency change bites hardest. Sterilization, as a process you validate rather than inspect, is the clearest test of whether your supplier oversight is real or nominal.

The readiness window is the moment to fix that deliberately — to re-index procedures, harden supplier files, confirm outsourced-process validation, and decide whether fewer, stronger vendor relationships beat managing a sprawl of inspectable quality systems. Future spokes in this hub will go deeper on EO and gamma cycle development, dose setting under ISO 11137, sterilization method selection, and the documentation pitfalls that turn a validated process into a 483.

If you're consolidating contract manufacturing partners during the QMSR transition, our quality and sterilization teams can walk through your supplier-control records and outsourced-process validation in a 30-minute technical review — and show you what an FDA inspector would now see.

Request a Quote

Ship faster with fewer vendors

LSO consolidates assembly, packaging, validation, and sterilization under one roof — FDA-registered, ISO 13485-certified, across three facilities. Tell us about your device and we'll map the fastest path to production.

Request a Quote

Or call us directly: (714) 672-1090