Quality Management System (QMS) is the documented structure of policies, processes, procedures, and records that a medical device organization uses to control design, production, distribution, and post-market activity. In regulated MedTech, a QMS is a legal requirement, defined by ISO 13485:2016 and enforced through FDA 21 CFR Part 820 and EU MDR 2017/745.
What is a Quality Management System (QMS)?
A quality management system (QMS) is the operating framework that ties every regulated activity in a device company to a written procedure, a responsible owner, and an auditable record. It covers management responsibility, resources, product realization, and measurement. It is not a binder of documents but the way work actually gets done, evidenced.
The reference model for medical devices is ISO 13485:2016. Unlike ISO 9001, which centers on customer satisfaction, ISO 13485 centers on regulatory conformity and risk control. The QMS spans the full lifecycle: design inputs and outputs, supplier qualification, process validation, sterilization and packaging controls, complaint handling, and vigilance reporting.
Why a Quality Management System (QMS) matters in medical device development
Without a certified QMS, a device cannot be legally placed on most markets. EU MDR Article 10(9) obliges manufacturers to establish, document, and maintain a QMS. In the United States, the Quality Management System Regulation (QMSR) took effect on February 2, 2026, replacing the old Quality System Regulation and incorporating ISO 13485:2016 by reference into 21 CFR Part 820. Notified bodies and FDA investigators both audit against it.
The commercial stakes track the regulatory ones. QMS gaps surface as nonconformities in a notified body audit, as FDA Form 483 observations, or as warning letters. Each stalls a launch. Late design history file remediation costs far more than building records correctly as engineering proceeds.
Patient safety sits underneath. Traceability, change control, and CAPA exist so that a defective lot can be identified, contained, and recalled before it reaches more users.
Key components of a medical device QMS
ISO 13485:2016 organizes requirements into clauses. A working QMS turns those clauses into linked processes:
- Management responsibility and quality policy (Clause 5). Documented objectives, defined authority, and periodic management review with recorded actions.
- Document and record control (Clause 4.2). Version control, approval routing, retention periods, and a Medical Device File for each device family.
- Design controls (Clause 7.3). Design inputs, outputs, review, verification, validation, transfer, and change control are compiled into a design history file.
- Risk management (ISO 14971:2019). Risk analysis is integrated across design, production, and post-market phases, not run as a separate exercise.
- Purchasing and supplier control (Clause 7.4). Supplier qualification, audits, incoming inspection, and controls proportionate to component risk.
- Production and process control (Clause 7.5). Work instructions, process validation (IQ/OQ/PQ), cleanroom and environmental controls, identification, and traceability.
- Measurement, analysis, and improvement (Clause 8). Internal audits, complaint handling, nonconforming product control, CAPA, and vigilance or MDR reporting.
Device software carries its own layer: IEC 62304 governs software lifecycle processes, and IEC 62366-1 governs usability engineering. Both feed evidence back into the QMS.
The QMSR adds requirements that ISO 13485 does not fully cover. Section 820.35 sets content rules for complaint and service records. Section 820.45 retains labeling and packaging inspection controls. Certification to ISO 13485 alone does not satisfy Part 820.
Common challenges and best practices
Most QMS failures are not failures of intent. They are failures of scale. A startup writes procedures for a ten-person team, then keeps them unchanged through a fifty-person hiring wave, and the system stops describing reality. Auditors notice the gap at once.
Over-documentation is the mirror-image error. Procedures written in such detail that nobody follows them turn every routine task into a deviation. Write the minimum that satisfies the clause and reflects real practice.
Other recurring problems and what good looks like:
- CAPA as a filing cabinet. Records get opened, root cause is skipped, and actions close without effectiveness checks. Good CAPA has a defined root-cause method and a verification step with objective evidence.
- Design controls applied retroactively. Engineering builds, then documents. Instead, capture design inputs before architecture freezes and let verification protocols drive test planning.
- Supplier controls that stop at a questionnaire. Tier the supply base by risk, audit critical suppliers, and define change notification duties in the quality agreement.
- Training records that lag reassignments. Tie training to the role, and gate the procedure release on completed training.
How SJML helps with Quality Management System (QMS)
Syrma Johari MedTech is an end-to-end medical device CDMO operating under a certified ISO 13485 quality management system, with information security managed to ISO 27001. Programs run against FDA 21 CFR Part 820, EU MDR and IVDR, MDSAP, Health Canada, and CDSCO expectations across Class I, II, and III devices. QARA teams support QMS build-out and remediation, ISO 14971 risk files, design history file work, supplier audits, CAPA, and post-market surveillance. Design, engineering, and manufacturing sit under one quality system.
Frequently asked questions
No. ISO 13485:2016 certification means an accredited body audited the quality management system against the standard. It does not by itself satisfy the FDA QMSR, which adds requirements in 21 CFR 820.10, 820.35, and 820.45 covering design applicability, record content, and labeling controls. Manufacturers selling into the United States must meet both and remain subject to FDA inspection.
Earlier than most founders expect. Design controls under ISO 13485 Clause 7.3 apply from design inputs onward, so records from feasibility and prototyping may need to sit in the design history file. Building a lightweight QMS before design freeze avoids retrospective documentation, which auditors treat with suspicion and which consumes engineering time during the run-up to submission.
The Quality System Regulation was replaced by the Quality Management System Regulation on February 2, 2026. Part 820 now incorporates ISO 13485:2016 by reference rather than restating requirements. The FDA also retired the Quality System Inspection Technique and moved to a revised inspection program. Risk management is now explicit throughout the quality system rather than confined to design validation.
Size it to device risk and organizational complexity, not to page count. A Class I accessory manufacturer needs far less procedural depth than a Class III implant maker. ISO 13485 permits exclusion of clauses that do not apply, provided the justification is documented. Auditors assess whether processes are effective and followed, not whether the manual is long.
Related terms
- ISO 13485
- Design Controls
- CAPA
- Design History File (DHF)
- ISO 14971
