How QMSR Affects Medical Device Suppliers

Procurement teams that built their supplier controls around the FDA's former Quality System Regulation (QSR) now have a revised framework to account for. The Quality Management System Regulation (QMSR) became effective February 2, 2026, amending 21 CFR Part 820 and incorporating ISO 13485:2016 into the FDA's medical-device quality system requirements.

Understanding how QMSR affects medical device suppliers starts with an important distinction: the regulation does not automatically apply to every company that supplies a component or service to a medical device manufacturer. QMSR applies to manufacturers of finished devices intended for commercial distribution, including certain accessories that meet the definition of a finished device.

For many machining and component suppliers, the practical impact instead comes through their customers. Medical-device manufacturers must maintain purchasing and supplier controls within their quality management systems (QMS), which can affect how procurement qualifies suppliers, sets requirements, monitors performance, manages changes, and documents corrective action.

For procurement teams, the transition is less about adding paperwork and more about documenting supplier decisions and applying risk-based controls.

What Changed From QSR to QMSR?

QMSR is the revised 21 CFR Part 820 framework for medical-device current good manufacturing practice (CGMP) requirements. The FDA has described the change as an effort to harmonize its medical-device quality framework more closely with quality-management requirements used by other regulatory authorities.

Under the former QSR, Medical device manufacturers followed the previous Part 820 structure, which contained the FDA's quality system requirements.

Under QMSR, Part 820 incorporates ISO 13485:2016 as its foundational QMS framework while retaining additional FDA-specific provisions. This brings concepts such as risk management and risk-based decision-making into closer alignment with the internationally recognized standard.

Incorporating ISO 13485 does not replace other applicable requirements under the Federal Food, Drug, and Cosmetic Act or other FDA regulations.

The transition also changed FDA inspections. The FDA has since replaced the Quality System Inspection Technique (QSIT) with the inspection process described in Compliance Program 7382.850.

For procurement, the change goes beyond the structure of Part 820. Supplier qualification, purchasing, and monitoring records may now be reviewed within a QMS, in accordance with the incorporated ISO 13485 requirements. The FDA's current inspection program specifically identifies outsourcing and purchasing as a QMS area covering outsourced activities, purchasing processes, purchasing information, and purchased products.

How Does QMSR Affect Medical Device Suppliers?

A supplier's direct regulatory status depends on what it manufactures and its role in the device supply chain. QMSR directly governs FDA-regulated manufacturers within its scope, while many component and service suppliers experience its requirements indirectly through their medical-device customers' purchasing and supplier controls.

FDA defines a finished device as “any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.” Because some components may qualify as finished devices when treated as accessories, whether QMSR applies to a supplier depends on the specific products and activities involved.

For machining suppliers producing components to customer specifications, how QMSR affects medical device suppliers may be most apparent in customer qualification and purchasing requirements.

Supplier oversight may include areas such as:

• Supplier evaluation and selection: Approval should be based on the supplier’s ability to meet defined requirements.
• Risk-based controls: Supplier oversight should align with the risks associated with the device and the purchased product.
• Purchasing specifications: Suppliers should receive clear requirements for the expected product or service.
• Purchased-product verification: Inspection or verification should consider supplier performance and product risk.
• Performance monitoring: Supplier performance should continue to be reviewed after approval.
• Change control: Supplier changes that could affect the product or related processes should be reviewed.
• Nonconformance handling and corrective action: Supplier issues should be addressed based on their significance and risk.
• Controlled records and traceability: Records should show that purchasing and supplier controls are being followed.

Under ISO 13485 Clause 7.4, FDA notes that supplier evaluation considers supplier ability and performance, the impact on finished-device quality, and associated risk, with continued monitoring and reevaluation.

Procurement insight: Supplier certification is evidence, not the sole basis for the qualification decision. ISO 13485 certification can indicate that a machining partner operates within a medical-device-focused QMS, but procurement still needs to evaluate its actual capabilities, controls, documentation, and performance against the requirements and risk of the specific component or program.

How Do Risk-Based Supplier Controls Change?

Under QMSR, supplier oversight should reflect risk. FDA guidance on ISO 13485 Clause 7.4 states that supplier evaluation and selection criteria should be proportionate to the risk associated with the medical device. When purchasing requirements are not met, the response should also consider the risk of the purchased product and applicable regulatory requirements.

In practice, procurement can use several factors when determining the appropriate depth of supplier control:

• Component criticality: What could happen to device quality if the component fails to meet requirements?
• Process complexity: Does manufacturing involve processes that require greater control or specialized capability?
• Supplier performance: Has the supplier demonstrated consistent quality, delivery, and documentation performance?
• Special or outsourced processes: Are critical operations performed outside the supplier's direct facility or control?
• Verification capability: Can conformity be adequately verified after receipt, or must greater confidence come from process and supplier controls?
• Traceability needs: What level of material, lot/batch, or heat-lot traceability is necessary?
• Quality history: Are recurring nonconformances, CAPAs, or other performance issues present?

These factors provide a practical guide for procurement rather than a universal FDA checklist. They help teams determine how much supplier oversight is appropriate based on risk.

Procurement insight: Applying the same audit depth to every supplier does not necessarily create stronger control. A more defensible approach is to document why a higher-risk supplier receives greater scrutiny than one whose product presents substantially less risk.

Supplier Qualification and Re-Evaluation

Supplier qualification should specify the evidence required before approval and explain why that evidence is sufficient for the supplier's role.

ISO 13485's purchasing framework requires supplier evaluation and selection to consider the supplier's ability to meet requirements, supplier performance, the effect of the purchased product on device quality, and associated risk. It also requires supplier monitoring and re-evaluation.

This makes supplier qualification an ongoing process rather than a one-time approval. When re-evaluation is required, manufacturers may consider supplier scorecards, quality performance, audit findings, delivery history, documentation, and changes in component or process risk.

Corrective Action and Supplier Performance

Supplier problems should also feed back into the level of oversight.

A recurring dimensional nonconformance, documentation failure, or purchasing-requirement issue may justify deeper investigation or additional supplier controls, depending on its significance. FDA guidance also states that the response to unmet purchasing requirements should reflect the risk associated with the purchased product.

A Supplier Corrective Action Request (SCAR) can be used to document an investigation, root cause, corrective action, and effectiveness when included in a manufacturer’s procedures. QMSR does not specifically require the use of a SCAR.

The important question is whether the response is appropriate to the problem and its risk.

What Supplier Documentation Matters Under QMSR?

The appropriate supplier documentation depends on the purchased product, its risk, applicable specifications, and the manufacturer's QMS procedures. The goal is not to request every possible record from every supplier. It is to maintain objective evidence that purchasing requirements and supplier controls have been defined and are working as intended.

Depending on the supplier relationship, documentation may include:

• Approved supplier and qualification records
• Supplier evaluation and re-evaluation evidence
• Purchasing specifications and quality requirements
• Certificates of conformance
• Material certifications
• Inspection and verification records
• Lot/batch or heat-lot traceability
• Revision-controlled drawings and work instructions
• Subcontractor and special-process documentation
• Nonconformance and CAPA records
• Supplier change notifications
• Training or competency evidence when relevant to the qualification

Supplier records may also support the finished-device manufacturer’s QMS and medical device file documentation, as well as provide evidence of supplier and purchasing controls during FDA inspections. This does not mean machining suppliers must maintain the manufacturer’s medical device file, only that their documentation may support the manufacturer’s own requirements.

Change Notification and Purchasing Controls

Clear purchasing information is particularly important when supplier changes could affect the finished device.

Requirements communicated to the supplier should adequately define the product and applicable quality expectations. Under ISO 13485 purchasing controls, written agreements should address supplier notification prior to product changes, an approach also reflected in the FDA’s MDSAP purchasing guidance.

For precision components, changes to materials, processes, manufacturing locations, equipment, or sub-suppliers may affect downstream qualification or validation. Procurement teams should have a clear process for receiving and assessing these changes and involving quality or engineering when needed.

Procurement insight: A shipment can meet dimensional requirements and still raise supplier-quality concerns if required documentation is incomplete or a relevant process change occurred without appropriate notification.

What Should Procurement Review Now?

Procurement does not necessarily need to rebuild its supplier program from scratch for the transition from QSR to QMSR. A more practical starting point is a comparative or gap analysis of existing supplier qualification, purchasing, monitoring, and documentation practices against the current framework.

FDA specifically notes that manufacturers may find a comparative analysis useful when determining whether documents and records created before the February 2, 2026, effective date meet QMSR requirements. FDA investigators may also review QMS records created before that date.

QMSR Supplier Review: 6 Areas to Check

1. Segment suppliers by risk.
Review whether supplier classifications still reflect component criticality, manufacturing complexity, supplier performance, and the potential effect of failure on device quality. Higher risk may justify more extensive qualification, verification, monitoring, or auditing.

2. Review qualification and approval criteria.
Confirm that approval decisions can be supported by defined criteria and objective evidence. Certification status and a long supplier relationship may contribute to the decision, but neither replaces evaluation of the supplier's ability to meet applicable requirements.

3. Review purchasing and quality requirements.
Check whether purchase documents, drawings, specifications, and quality agreements clearly define applicable product requirements, documentation, traceability, verification, and supplier change-notification expectations.

4. Review monitoring and re-evaluation.
Determine how quality performance, delivery, audit findings, nonconformances, corrective actions, and documentation affect a supplier’s status after approval. When audits are part of this process, a medical device supplier audit checklist can help you review relevant controls based on the supplier’s component and process risk.

5. Review nonconformance and corrective-action escalation.
Confirm that supplier problems are escalated according to their significance and risk. Where corrective action is required, records should demonstrate appropriate investigation, response, and follow-up in accordance with the manufacturer's established procedures.

6. Review documentation and audit readiness.
Ask whether someone unfamiliar with the original sourcing decision could reconstruct why a supplier was approved, what controls were assigned, how its performance has been monitored, and why those controls remain appropriate.

This is especially relevant under QMSR because FDA investigators may now review supplier audit reports. The previous QSR exemption that restricted FDA access to certain management review, quality audit, and supplier audit reports was not retained.

Procurement insight: QMSR puts greater emphasis on whether supplier controls can be supported by clear evidence and remain appropriate as supplier performance and risk change.

Building a QMSR-Ready Supplier Strategy

QMSR brings FDA's Part 820 framework into closer alignment with ISO 13485:2016, but its supplier implications ultimately concern making risk-based sourcing decisions that can be supported by evidence. The appropriate level of oversight will vary with the supplier's regulatory role, the risk of the purchased product, applicable requirements, and performance.

For procurement teams, that means coordinating with quality and engineering when qualification criteria, purchasing requirements, change controls, or supplier records are unclear. Strong supplier quality management depends on understanding not only whether a supplier holds a certification, but whether its processes and capabilities fit the requirements of the specific program.

When evaluating a machining partner for regulated medical-device work, reviewing its quality certifications and compliance standards can be one useful part of that assessment. Swiss Machine Products documents ISO 9001 and ISO 13485 certification along with its approach to process control and traceability, but those credentials should still be evaluated alongside program-specific capabilities, documentation, risk, and performance requirements.