Copy to clipboard 
FDA’s Quality Management System Regulation (QMSR) officially took effect on February 2, marking the most significant overhaul of medical device quality oversight in nearly 30 years.
QMSR replaces the Quality System Regulation (QSR) framework with an approach that incorporates ISO 13485:2016 by reference and reorganizes inspections around systems-level risk evaluation.
Under the QSR framework, quality inspections were largely guided by the Quality System Inspection Technique (QSIT), which divided reviews into discrete subsystems. Compliance often centered on whether procedures existed and were followed.
FDA’s focus has shifted from verifying compliance to evaluating whether risk-based thinking is embedded across the entire product lifecycle.
“It’s a good step because the former FDA regulation was really outdated,” said Monica Burt, Founder and CEO of MB&A. “The harmonization with ISO 13485:2016 will ultimately reduce compliance burden for companies operating globally, as notified body audits and FDA inspections will now evaluate against substantially similar standards.”
Burt said there is a significant amount of hidden patient risk embedded in current systems and believes the new auditing techniques and regulatory changes will bring much more of that risk to light.
“Ultimately, that’s a positive development for patients,” she said, “but it will require a substantial adjustment across the industry.”
Burt said orthopedic manufacturers should immediately prioritize the following actions to begin making that adjustment and achieve inspection readiness:
1. Audit Your Documentation for Risk-Based Rationale
Review recent quality decisions — design changes, process modifications, deviation dispositions, supplier qualifications — and ask: “Is there documented evidence of the risk-based thinking that supported this decision?”
FDA is no longer satisfied with evidence that procedures were followed. They want to see evidence that risks were considered, evaluated, and managed. This applies to decisions across the quality system.
Design Changes. Beyond documenting what changed, document why the change does not introduce new risks or impact existing risk controls. For orthopedic implants, this includes evaluating how design modifications affect mechanical properties, biocompatibility, osseointegration potential, or surgical technique.
Process Modifications. Document risk assessments for changes made “for manufacturing convenience” or efficiency improvements. An early QMSR inspection revealed a 483 observation for a heat treat order-of-operations change that had a CAPA and photos, but lacked a documented risk assessment justifying why the new sequence did not impact the final product.
Deviation Dispositions. Document the risk-based rationale for “use as is” decisions, even when engineering judgment is sound. Another early observation involved a calibration tool that failed upon receipt. An engineer performed a mental calculation and approved “use as is,” but the lack of documented rationale resulted in a 483 observation.
Supplier Qualifications. Document risk assessments of supplier capabilities and quality system maturity, not just technical specifications. Evaluate whether the supplier’s validation protocols, change control processes, and risk management systems meet QMSR expectations.
2. Strengthen Supplier Quality Management
The “Rollsuphill Effect” — where quality system gaps at CMs create direct regulatory liability for OEMs — requires a complete rethinking of supplier quality management. OEMs must now verify that their suppliers’ quality systems meet QMSR-level expectations for risk-based decision-making and process validation rigor.
Conduct QMSR-Focused Supplier Audits. Traditional supplier audits focus on compliance with contractual requirements and basic quality system elements. QMSR-focused audits must evaluate:
- Does the supplier perform documented risk assessments for process changes?
- Are process validations statistically robust and current?
- Does the supplier’s change control process require risk-based rationale?
- How does the supplier manage validation maintenance, and revalidation triggers?
- Are management reviews, internal audits, and supplier audits documented at a level that would withstand FDA inspection?
Establish Synchronized Change Control. Create mechanisms to ensure that when a CM makes process changes, the OEM is notified and can evaluate whether additional risk assessment or validation is required at the OEM level. This may require contractual provisions that obligate the CM to notify the OEM of any process changes that could affect product characteristics.
Verify Process Validation Adequacy. Don’t assume that because a CM has validated a process, the validation meets QMSR expectations. OEMs should review validation protocols for statistical rigor, sample sizes, acceptance criteria and ongoing validation maintenance. For critical orthopedic processes such as welding, surface treatments, or sterilization, request validation summary reports and verify that the CM has a plan for ongoing process monitoring and revalidation.
Map Critical Supplier Processes. Identify which supplier processes directly impact product safety and effectiveness (e.g., sterilization, surface treatments, critical dimensions, and mechanical property-affecting processes, for example). These processes require the highest level of oversight and validation verification.
3. Prioritize Process Validation Gaps
Early QMSR inspections have revealed that many established processes — particularly those validated years ago under previous standards — do not meet current expectations for statistical rigor and documented risk assessment.
For orthopedic manufacturers, high-risk areas include:
- Welding and joining processes for implant components, especially when visual inspection is the primary verification method.
- Surface treatment processes (plasma spray, anodization, passivation) where validation relies on periodic sampling rather than statistical process control.
- Sterilization validation that has not been updated to reflect equipment changes or process drift.
- Machining processes for critical dimensions where fixture modifications or tooling changes have occurred without formal revalidation.
- Assembly processes for multi-component implants where torque specifications or sequence changes have been made.
The QMSR expectation is that process validation demonstrates statistical confidence in process capability and repeatability, not just evidence that the process has been performed successfully in the past.
Manufacturers should conduct a validation gap assessment to identify processes that need revalidation or enhanced statistical analysis.
4. Prepare for New Inspection Methodology
QMSR inspections differ from QSR inspections in approach and focus.
Risk-Based Sampling. Inspectors will select which quality system elements to evaluate based on their assessment of which areas pose the greatest risk to patients or device users. For orthopedic implant manufacturers, expect heightened scrutiny of design controls, process validation, and supplier management for Class II and Class III devices.
Systems-Based Evaluation. Inspectors may trace a single quality system element (such as CAPA or change control) through multiple interconnected processes to evaluate systems-level effectiveness. This means isolated documentation gaps can reveal broader systemic issues.
Management Review and Audit Scrutiny. With management reviews, internal audits, and supplier audits now subject to FDA review, ensure these activities are documented with the same rigor as other quality system records. Inspectors will evaluate whether management reviews include appropriate inputs (such as risk management data, postmarket surveillance, and customer feedback) and whether audit findings are appropriately investigated and closed.
Expectation of Continuous Improvement. The QMSR emphasizes that quality systems should evolve and improve over time. Inspectors may ask how the organization has improved its quality system based on internal audits, CAPAs, or industry trends — not just how it maintains compliance.
5. Train Teams on Risk-Based Documentation
Quality professionals, engineers, and manufacturing personnel must understand that under the QMSR, undocumented rationale is equivalent to no rationale. Even when technical decisions are sound, the absence of documented risk-based thinking creates regulatory exposure.
Training should emphasize:
- How to document risk assessments for routine quality decisions (not just formal design changes).
- What constitutes adequate risk-based rationale in the eyes of QMSR inspectors.
- When to escalate decisions for formal risk assessment vs. documenting rationale in existing quality records.
- How to integrate risk thinking into daily quality activities, not just formal risk management processes.
Capitalizing on the Opportunity
Burt said that manufacturers face a choice in how they respond to the QMSR.
A tactical approach focuses on immediate inspection readiness to reduce 483 observation risks by closing documentation gaps, reinforcing supplier oversight, and addressing known validation weaknesses.
A strategic approach treats the QMSR as a catalyst for modernization by digitizing quality systems, integrating supplier management platforms, and embedding risk-based thinking across the organization. The strategic approach requires more investment, but positions your organization for long-term competitive advantage.
Burt suggests that orthopedic manufacturers achieve inspection readiness now through immediate actions to strengthen documentation, supplier oversight, and process validation, while simultaneously planning for longer-term quality system transformation that embraces the QMSR’s emphasis on systems thinking and risk-based management.
“The manufacturers who treat the QMSR as an opportunity for quality system modernization, rather than merely a compliance burden, will emerge stronger and more competitive in the years ahead,” she said. “Those who delay or attempt to maintain QSR-era practices will find themselves facing increasing regulatory scrutiny and 483 observations that could have been prevented with proactive preparation.”
Secure your spot at OMTEC 2026 to hear Monica Burt speak about implementing AI to predict and prevent supplier risk.
