FDA QMSR 2026: the small manufacturer guide

The Quality Management System Regulation (QMSR) is now the operating reality for FDA-regulated medical-device manufacturers. It became effective on February 2, 2026, incorporates ISO 13485:2016 by reference, and changes the way FDA describes its inspection approach. The FDA's QMSR page is the source of truth for the rule, inspection program, and official updates. This guide translates that change into a 90-day plan for a small manufacturer with one quality manager and a busy production floor.

First, what QMSR does and does not mean

QMSR is not a request to buy an ISO binder or rewrite every procedure. It is a change in the regulatory frame around your quality system. ISO 13485 language now sits inside the FDA requirement, while device-specific obligations, records, complaint responsibilities, and applicable FDA regulations remain part of the operating environment.

Your first job is to understand the difference between a requirement, a procedure, and evidence. A requirement says what must be controlled. A procedure says how this shop controls it. Evidence proves the process happened for this device or lot. Most small manufacturers have an evidence problem: the procedure says one thing, the record says another, or the record exists but cannot be connected to the device history.

The QMSR readiness map

Build a crosswalk before you edit anything. Put your current procedure or record in one column, the applicable ISO 13485 process in another, and a short evidence verdict in a third. Use four verdicts: works, works with a gap, not used, and unknown. “Unknown” is useful; it tells you to sample the floor rather than debate the document.

Prioritize device and customer requirements; design and development where applicable; purchasing and external providers; production and process validation; identification and traceability; monitoring, measuring, and equipment; feedback, complaints, and CAPA; and management responsibility. For each, ask: what is the risk, who owns the process, what record proves it, and can we retrieve that record from a lot number?

A 90-day plan for a lean team

Days 1–15: establish the truth

Choose three recent device or lot records: one clean, one late, and one with a nonconformance or complaint. Trace each from contract review to shipment. Do not fix the record while sampling it. Write down every missing link, conflicting revision, and “we know this happened, but there is no record” moment. Create a risk-ranked action register; safety, identity, performance, or reporting gaps get near-term owners.

Days 16–45: repair the highest-risk loops

Fix the workflow at the point of use. If receiving inspection is skipped because the form is hard to find, redesign the handoff. If operators use local copies, make the controlled version easier to access than the obsolete copy. If complaints arrive in a shared inbox, add a numbered intake record and a clear escalation decision. Run one complete CAPA using real evidence, with an effectiveness check that tests recurrence.

Days 46–75: make the system auditable

Run a process-based internal audit. Follow a real job rather than reading every clause in order. Interview the person who performs the work, compare their answer to the approved instruction, and sample the resulting record. Record conditions and evidence. Hold management review with decisions on resource needs, supplier risk, overdue actions, complaint trends, training gaps, and changes that could affect the device.

Days 76–90: rehearse and sustain

Ask: “Show me every record needed to explain this lot.” Start with the lot number and work backward. Then ask: “How do you know the process is still effective?” Your answer should combine records, trends, and a recent human conversation. Freeze the crosswalk as a controlled working document and review it when a process changes or a new expectation appears.

Five records to make excellent first

1. Device or lot record: revision, material, process, inspection, deviations, and release in one chain.
2. Supplier record: approval rationale, risk, incoming evidence, performance, and action history.
3. Complaint record: intake, investigation, reportability decision, correction, and feedback to CAPA.
4. CAPA record: verified cause, action owner, due date, and effectiveness result.
5. Management review record: inputs that matter, decisions made, resources assigned, and follow-through.

Download the NCR and CAPA starter forms. Pick one shipped lot. Trace it with traceability, log the first gap as a controlled action, and review it with the process owner. Norma's CAPA, document control, and product integrity modules follow the same loop: run the shop correctly, and build the evidence as you work.