Guidance Breakdown: QMS Information for Certain Premarket Submission Reviews
What device firms need to include (and update) before February 2026 to keep their PMAs and HDEs moving under the new QMSR framework.
This guidance breakdown is available in full to paid subscribers. Only paid subscribers get regular full access to our guidance breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.
Today’s guidance breakdown is for the device and medtech teams among us. With the Quality Management System Regulation (QMSR) taking effect on February 2, 2026, the FDA has released a new draft guidance detailing its expectations for QMS information in PMA and HDE submissions.
This draft, issued by the CDRH, supersedes the 2003 guidance “Quality System Information for Certain Premarket Application Reviews”.
It’s intended to be a practical roadmap for aligning submission content with the FDA’s newly harmonized QMSR, built on ISO 13485:2016 and ISO 9000:2015.
Under the QMSR, the FDA will evaluate marketing submissions for conformance with ISO 13485 as incorporated into 21 CFR Part 820. Beginning February 2 of next year, reviewers will expect to see clear, structured evidence that a manufacturer’s QMS aligns with these requirements.
The agency explicitly recommends including a “gap analysis or other comparative analysis” when pre-QMSR records are referenced in submissions.
In essence, PMA and HDE applicants must now demonstrate—not just assert—QMSR compliance through documentation that maps directly to ISO 13485 clauses.
We've distilled the key points below. If you still need QMSR compliance support before February, get in touch to schedule your gap assessment and update project. We’re booking subject matter experts to work on QMSR updates through the end of the year and into 2026.
Also, paid subscribers can download our QMSR gap analysis worksheet here:
Here’s a distillation of the new guidance and what we recommend teams do in light of it.
Shifting from narrative to evidence in submissions
A big theme of change this guidance signals is the move away from what we’d call “narrative” documentation toward pure evidence documentation.
FDA reviewers will clearly be looking for verifiable, traceable documentation (procedures, plans, risk analyses, validation records), not the generalized descriptions that we still see in submissions today.
This reflects the broader philosophy baked into ISO 13485: that a QMS should be demonstrable through objective evidence at every turn. If you’re accustomed to the more flexible narrative approach of the past, this might mean some change in mindset.
The guidance also makes clear that the FDA expects submissions to reflect the full description of manufacturing methods, facilities, and controls required by section 515(d)(2)(C) of the FD&C Act. This means including or at least summarizing documentation across five key areas corresponding to ISO 13485 clauses:
Establishing a QMS: Describe risk-based controls for processes and outsourced activities and provide a quality manual, policy statements, document control procedures, and medical device files.
Management responsibility: Identify management reps and include management review procedures and summaries showing oversight effectiveness.
Resource management: Provide facility diagrams, maintenance plans, and risk-based maintenance schedules. Also, regulators want you to describe environmental controls, contamination prevention plans, and cleanroom validations when applicable.
Product realization: Detail your design and development plans, risk management linkages, traceability matrices, verification and validation summaries, and change control procedures. Include supplier evaluation and monitoring procedures, production flow diagrams, process validation plans, and software validation approaches.
Measurement, analysis, and improvement: Submit feedback and complaint handling processes aligned with 21 CFR Part 803, internal audit procedures, CAPA, and preventive action mechanisms.
Risk management is now a central thread
Throughout the guidance, the FDA repeatedly emphasizes risk-based approaches—from supplier control and process validation to corrective and preventive actions.
While ISO 14971 isn’t explicitly referenced in QMSR, the guidance makes clear that risk management principles should inform every major process decision. This is a notable expansion from the old QS regulation, where risk management was primarily confined to design controls.
Under QMSR, manufacturers need to demonstrate how risk management informs decisions across the entire product lifecycle, including production, monitoring, supplier management, and post-market activities.
For submissions, this means that nearly every section of your QMS documentation should include some explanation of how risk informed the approach.
When describing supplier controls, for example, you should explain how the extent of verification activities was determined based on supplier evaluation results and the risks associated with the purchased product.
When outlining process validation plans, you should demonstrate how the validation approach was scaled to the criticality of the process.
What the FDA expects in submissions
The guidance recommends using eSTAR templates and modular PMA submissions to improve clarity and efficiency.
For firms with multiple manufacturing facilities, the FDA wants separate volumes that clearly identify which facility performs which activities, along with a production flow diagram that schematically shows how all manufacturing processes, entities, and process controls fit together.
Let’s break down the specific expectations in a little more practical detail here:
QMS basics
The FDA of course wants to see your quality manual, policy statements, document control procedures, and medical device files. But beyond these basic elements, the guidance asks for something more substantive: a summary of your risk-based approach to controlling QMS processes and outsourced activities.
This is where many firms may need to enhance their existing documentation. It’s not enough to have procedures for outsourced processes. You need to explain the methodology you used to determine the appropriate level of control based on risk and supplier capability.
Similarly, for QMS software like electronic batch record systems or design control software, you need documented validation approaches that explain how validation rigor scales with the criticality of the software function.
Our recommendations:
Consider creating a three-tier outsourcing risk matrix (high/medium/low) that categorizes all your outsourced activities with control methodologies for each tier.
For high-risk activities like sterilization, make sure to document any enhanced controls including qualification audits, batch-by-batch verification, and contingency suppliers.
For QMS software, you might want to run a criticality assessment using the GAMP 5 categories and scale validation rigor accordingly. Category 5 (custom) software affecting product realization needs full IQ/OQ/PQ with traceability to user requirements, while Category 3 (non-configured) commercial tools may need only documented operational checks.
Bundle this all into a validation master plan that reviewers can quickly reference to understand your risk-based approach.
Management responsibility and oversight
The FDA says it wants to see more than just organizational charts when looking at management. The guidance specifically asks teams to identify management representatives with specific QMS responsibilities, along with management review procedures and summaries showing oversight effectiveness.
The keyword here (at least to us) is effectiveness.
The FDA wants evidence that management review actually drives QMS performance, not just notes that you’re holding meetings. This means your management review summaries should demonstrate how inputs led to decisions, how those decisions were implemented, and what the results were.
For the subject device specifically, the FDA recommends including a summary of management review inputs and outputs to show this closed-loop system in action.
Our recommendations:
You may want to restructure your management reviews to follow a standardized agenda that tracks trending metrics quarter over quarter, rather than just current snapshots. Include specific QMS performance indicators like design change cycle time, supplier nonconformance rates, CAPA effectiveness measures, and complaint response times.
For each metric that’s off-target, document the management decision, assigned owner, target completion date, and verification method. Then track these in subsequent reviews to demonstrate closed-loop effectiveness.
For submissions, prepare a device-specific management review summary showing the last three reviews with clear evidence that management decisions drove measurable improvements in QMS performance for that specific product line.
Resource management for facilities and environment
On resource management, the guidance gets quite specific about infrastructure and work environment requirements.
The FDA wants facility diagrams demonstrating sufficient space to prevent product mix-up and ensure orderly handling. But the guidance goes further, asking for risk-based maintenance schedules that explain how you determined maintenance intervals for equipment used in production, environmental control, and monitoring.
For work environment and contamination control, the expectations vary significantly based on device type.
For implanted devices, the final surface cleanliness may be critical to medical safety and performance.
For electronically controlled devices, environmental protections against electrostatic discharge may be paramount.
The guidance explicitly recognizes this variability and asks for documentation tailored to your specific device and its associated risks.
Where cleanrooms or controlled environments apply, the FDA wants to see validation plans, protocols, and reports demonstrating that the environmental control systems work as intended.
The guidance notes that submitters should provide at least one related validation as an example, though the FDA may request additional information during review.
Our recommendations:
Some firms may want to do a facility-wide risk assessment that maps each work area to device characteristics it could affect (particulate contamination, microbial contamination, mix-up, ESD damage). Then, use this to justify your environmental classification and control strategy.
For critical areas, create environmental control validation packages that include worst-case challenge testing, not just empty room certification.
Document maintenance intervals using reliability data or manufacturer recommendations, explaining the rationale for any deviations.
For cleanrooms, go beyond ISO classification—document particle counts, microbial monitoring results, and gowning qualification studies that demonstrate actual performance under operational conditions. Submit one complete environmental validation package as an exemplar that shows your methodology.
Product realization (where details matter most!)
The product realization section is where the guidance becomes most detailed, particularly around design and development controls.
FDA expects design and development files to be comprehensive and well-organized, with clear traceability between inputs and outputs. Key elements include:
Design and development plans addressing all requirements of ISO 13485 Subclause 7.3.2
Complete documentation of inputs and outputs
Verification and validation plans and results
Detailed records of design reviews at various stages.
Super critically, the FDA wants a summary of all approved design and development changes, including those made after manufacturing units were initiated for verification and validation activities.
This last point deserves emphasis. Changes during development are common, but the FDA says it wants to see a justification for why these changes don’t impact the validity of verification and validation data, including any clinical data used to establish safety and effectiveness.
Changes should be grouped based on their impact on function, performance, usability, safety, and applicable regulatory requirements.
For design transfer, the guidance recognizes the complexity when multiple organizations are involved. Whether you’re working with contract manufacturers, component suppliers, or in-house facilities, the FDA wants to see procedures that explain how manufacturing controls and requirements are transferred to each organization, how essential information reaches the right people, and how you verify that the transfer was effective and complete.
Our recommendations:
Build a design history file architecture that’s submission-ready from the start. Create a master design traceability matrix in a spreadsheet or database that links every design input to corresponding outputs, verification activities, validation activities, and risk controls. When design changes occur, update the matrix to show impact propagation and whether reverification/revalidation was needed.
For design transfer, develop transfer checklists that are signed off by both sending and receiving organizations, documenting not just what was transferred but verification that the receiving site can execute to specification. Include process capability studies from the receiving site demonstrating they can meet critical parameters.
For the submission, provide the complete traceability matrix and a narrative summary explaining your design control process, supplemented by 2-3 example verification protocols and reports that demonstrate scientific rigor.
Purchasing and supplier controls
Given the prevalence of complex supply chains in medical device manufacturing, the guidance dedicates substantial attention to purchasing processes.
The FDA wants documented criteria for supplier evaluation and selection based on the supplier’s ability to provide conforming product, supplier performance history, and the effect of purchased product on device quality—all proportionate to risk.