Requirements for training have changed for medical device manufacturers under the US Food and Drug Administration’s (FDA) new Quality Management System Regulation (QMSR), which replaced the agency’s decades-old Quality System Regulation (QSR) on Feb. 2, 2026.
The FDA published its final QMSR rule, which harmonized the QSR with international quality systems standard ISO 13485:2016, in 2024. Under the QMSR, the QSR’s 21 CFR, Part 820.25 (Personnel) was replaced by ISO 13485’s Clause 6.2 (Human Resources). A QualityHub expert analysis comparing the two is provided in charts below.
Training has always been a hot topic in the medical device industry. QualityHub experts – made up of former FDA investigators, compliance officers, regulatory staff, and other industry professionals – have seen the issue of training come up repeatedly during agency inspections and in conversations about solutions to both intermittent and ongoing quality problems.
Our consultants routinely address training during audits; this often leads to theoretical discussions about the expectations of regulatory authorities and how to provide the best objective evidence to demonstrate compliance. Training is often the de facto root cause in nonconformances and corrective and preventive actions (CAPA). It’s also often listed as a corrective action or preventive action in these records as evidence of steps taken to remediate problems and achieve compliance.
Understanding how ISO 13485 differs from the former QSR – and how they’re sometimes the same – will help companies successfully navigate future FDA inspections and maintain compliance.
Why is the seemingly simple concept of training cited as a deficiency in audit and inspection outcomes? Will embracing ISO 13485 personnel competency requirements reduce problems and ensure they have the education, training, skills, and experience needed to perform their work?
Compliance is going to require systemic improvements in defining competency requirements based on job function and the performance, management, and documentation of training. Improvements in training could theoretically lower the temperature of problems related to employee competence. Understanding how ISO 13485 differs from the former QSR – and how they’re sometimes the same – will help companies successfully navigate future FDA inspections, maintain compliance, and embrace a culture of quality culture within the organization.
In the charts below, the FDA’s now-retired Part 820.25 requirements are listed alongside ISO 13485, Clause 6.2 requirements. QHub expert commentary based on this comparison is provided.
Training Requirements, Compared
Provision of Sufficient Personnel or Resources
| Old Part 820 Requirement (QSR) |
| 820.25(a): “Each manufacturer shall have sufficient personnel with the necessary education, background, training, and experience…” |
| New ISO 13485 Requirement (QMSR) |
| 6.2.1: Requires that the organization provide “resources needed” to implement and maintain an effective Quality Management System (QMS). |
| QHub Expert Commentary |
| The QSR’s training requirement addressed the need for manufacturers to have “sufficient personnel” and the need for the organization to ensure they had the necessary education, background, training, and experience to meet Good Manufacturing Practice (GMP) requirements. ISO similarly addresses this in Clause 6.1, which requires that the organization provide “resources needed” to implement and maintain an effective QMS that meets regulatory and customer requirements. |
Who Requires Training?
| Old Part 820 Requirement (QSR) |
| 820.25(b): “Each manufacturer shall establish procedures for identifying training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities.” |
| New ISO 13485 Requirement (QMSR) |
| 6.2: For personnel “performing work affecting product quality. …The organization shall … [6.2(b)] provide training or take other actions to achieve or maintain the necessary competence.” |
| QHub Expert Commentary |
| The QSR requirement was vague in that it didn’t specify which personnel in the organization the requirement applies to, simply referring to “all personnel.” It can be assumed that this was relevant to personnel working in functions that are regulated by GMPs. “All” is a subjective word that is impossible to quantify and evaluate in the scope of an audit. “All” isn’t a term that shouldn’t have been used in the FDA’s medical device requirements under the old QSR. ISO is more specific, clarifying that personnel require training if their work affects product quality. Interpretation requires connection between the “leading statement” in Clause 6.2 and the more discrete requirements that follow in Clause 6.2(b). |
Procedural Requirements
| Old Part 820 Requirement (QSR) |
| 820.25(b): “Each manufacturer shall establish procedures for identifying training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities.” |
| New ISO 13485 Requirement (QMSR) |
| 6.2: “The organization shall document the process(es) for … providing needed training…” |
| QHub Expert Commentary |
| The QSR required and ISO requires that procedures be established for training and competence. Both specify the need to document training needs. The assumption is that this refers to documenting the training needs for specific job functions or job roles. |
Demonstrating Competence
| Old Part 820 Requirement (QSR) |
| 820.25(a): Each manufacturer shall have sufficient personnel with the necessary education, background, training, and experience to assure that all activities required by this part are correctly performed.” |
| New ISO 13485 Requirement (QMSR) |
| 6.2: Personnel “shall be competent on the basis of appropriate education, training, skills, and experience.” Further, “the organization shall document the process(es) for establishing competence…” |
| QHub Expert Commentary |
| The FDA didn’t use the term “competency” in the QSR but stated the need to ensure personnel had the necessary education, background, training, and experience to correctly perform their job. ISO requires the need to establish procedures for demonstrating the competence of employees performing work that affects product quality. ISO indicates that competence is based, collectively, on a person’s education, training, skills, and experience. Merriam Webster defines “competent” as “having requisite or adequate ability or qualities,” while “competence” is defined as “the quality or state of having sufficient knowledge, judgment, skill, or strength (as for a particular duty or in a particular respect).” Considering these definitions, ISO 13485 doesn’t increase training expectations simply by using the term “competent.” The FDA’s expectation for this was always in the QSR, just worded differently. |
| Old Part 820 Requirement (QSR) |
| 820.25(b): “Each manufacturer shall … ensure that all personnel are trained to adequately perform their assigned responsibilities.” |
| New ISO 13485 Requirement (QMSR) |
| 6.2(b): The organization shall “provide training or take other actions to achieve and maintain the necessary competence…” |
| QHub Expert Commentary |
| Per ISO, demonstrating competency (i.e., sufficient knowledge, judgement, or skill) may be through training or “other actions” beyond training, which includes training that is self-directed, instructor-led, or on-the-job. One can presume that “other actions” might refer to the cumulative relevant experience and education described in a CV or resume, including certifications or completion of tests or examinations in a particular subject matter. Additional attention needs to be given to the ISO expectation that training and other actions are needed to maintain competence. This is important. Current standards and expectations for successfully implementing GMPs change over time. Ongoing training or education helps employees build their capabilities, keep pace with evolving subject matter, and identify improved ways of ensuring quality. Ongoing training and education links to demonstrating a culture of quality and continuous improvement. |
Defect Awareness
| Old Part 820 Requirements (QSR) |
| 820.25(b)(1): “As part of their training, personnel shall be made aware of device defects which may occur from the improper performance of their specific jobs.” 820.25(b)(2): “Personnel who perform verification and validation activities shall be made aware of defects and errors that may be encountered as part of their job functions.” |
| New ISO 13485 Requirements (QMSR) |
| 6.2: The organization shall document the process(es) for “ensuring awareness of personnel…” 6.2(d): The organization shall “ensure that its personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives…” |
| QHub Expert Commentary |
| In this case, the QSR directly addressed the requirement that personnel are aware of defects, which may occur if they don’t properly execute the tasks associated with the jobs. The FDA’s wording specifically established the expectation that personnel be trained on the defects that could result in improper performance of their job. For example, failure to follow process control instructions for a critical process could pose specific risks to patients or users. This type of defect awareness is sometimes included within the manufacturing work instructions that operators are trained on. ISO’s lead statement in Clause 6.2 is more general and clarified in Clause 6.2(d), which states that “personnel are aware of the relevance and importance of their job activities and how they contribute to the achievement of the quality objectives…” Communicating the overall businesses’ quality objectives throughout the organization is an important aspect of establishing a quality culture. All employees should understand they have a role in meeting these objectives. Consider also that the ISO reference to “quality objectives” is not necessarily just business annual quality objectives, but product-specific quality objectives to ensure products meet customer requirements. Individual employees perform tasks as part of their job function daily, which directly impact a product’s quality objectives. Making sure operators are aware of quality objectives relevant to their routine tasks is like the QSR requirement for defect awareness. It is important that personnel understand how a task they perform could directly impact product quality (i.e., the ability of the product to meet its performance and safety requirements.) This is, for example, directly relevant to those operators who perform QC testing, verification against an established specification, or validation that a specified requirement is met. There is an additional interpretation of the ISO requirement for personnel to be aware of how their activities contribute to achievement of quality objectives. For personnel in management roles, they should be aware of the company’s overall (e.g., annual) quality objectives. Their contribution to the achievement of these objectives could be demonstrated through their departmental objectives and/or personal annual objectives. Although there is a difference in wording, both the QSR and ISO emphasized the importance that operators performing functions related to product quality understand the risks associated by not performing their job as required. ISO’s broader requirement is well suited to the systems approach taken by the standard, as opposed to the task/job-oriented training approach in 21CFR, Part 820. |
Effectiveness of Training
| Old Part 820 Requirement (QSR) |
| No equivalent FDA requirement. |
| New ISO 13485 Requirement (QMSR) |
| 6.2(c): The organization shall “evaluate the effectiveness of the actions taken” in relation to training. |
| QHub Expert Commentary |
| The ISO requirement to evaluate effectiveness of training prompts the question, “How?” In traditional scholastic models the effectiveness of lessons is established through testing. Testing personnel on technical subjects following a training class can be a practical means of showing effectiveness of the training (at least in the short term). For tasks that require manual or practical skills: Following on-the-job training, certification of an operator is a common approach in which the operator demonstrates successful completion of a task to a qualified witness, for example. |
Training Records
| Old Part 820 Requirement (QSR) |
| 820.25 (b): “Training shall be documented.” |
| New ISO 13485 Requirement (QMSR) |
| 6.2(e): The organization shall “maintain appropriate records of education, training, skills, and experience…” |
| QHub Expert Commentary |
| ISO requires records that goes beyond training records. The implication is that documentation typically maintained by Human Resources (such as CVs and resumes) will become necessary objective evidence subject to audit and inspection. |
Our QHub review found that several features of ISO 13485 go beyond expectations conveyed through Part 820. These include the ISO standard’s direct delineation of who requires training; the correlation between training and quality objectives; the types of records that may be audited; the requirement for establishing and maintaining competence; and the need to demonstrate effectiveness.
Regarding demonstrating training effectiveness, FDA investigators and those auditing to the former Part 820 could only review training effectiveness in instances where training was used as a corrective or preventive action in a CAPA or nonconformance. But under ISO 13485, all training requires effectiveness. Training effectiveness isn’t easy to establish, and this will require some improvements in how training is performed and managed.
For example, many organizations use a “Read and Understand” process. With the need for training effectiveness, simply asking an employee to read a procedure isn’t adequate. Some types of training will lend themselves to confirmation of a person’s understanding through a simple post-training written test. In cases where an operator’s skill or ability to perform a specific task impacts product quality, an operator certification program can be established.
ISO’s reference to “Quality Objectives” should be interpreted broadly as both the company’s overall quality objectives and the quality objectives related to ensuring products meet specifications.
Certification implies that ability is demonstrated by a combination of evaluating the operator’s outputs to confirm proper performance of the task, along with other tests to confirm understanding of the task and defects that may occur if the task isn’t performed correctly. Monitoring nonconformance trends in operations may provide measurable evidence of operators’ skill levels, which can then be linked to the overall effectiveness of training programs.
Another point to consider is the linkage between training and the achievement of the organization’s quality objectives. The ISO requirement is that the organization shall ensure its personnel are aware of the organization’s quality objectives. With the former QSR, personnel weren’t specifically required to know about an organization’s quality objectives. That’s because Part 820 was silent on “quality objectives” altogether. Those of us in the quality industry are appreciative of the need for clearly stated and well understood quality objectives as listed in ISO 13485.
Quality objectives are an important element of Management Responsibility (ISO 13485, Clause 5.4.1). The objectives help top management ensure product and regulatory requirements are established. It makes good sense for employees to be aware of the organization’s quality objectives and how these are relevant to their job function.
ISO’s reference to “Quality Objectives” should be interpreted broadly as both the company’s overall quality objectives and the quality objectives related to ensuring products meet specifications. Ensuring employees understand these objectives broadly and how they’re directly relevant to their job function contributes to demonstrate a strong culture of quality.
Documentation of training is another example of where ISO 13485 goes beyond the old QSR. While the FDA required personnel to have the necessary education, background, training, and experience, Part 820.25 only required training records. It was inferred that the organization maintain the necessary records of education, background, training, and experience because those are requirements. But ISO 13485 is more direct. Clause 6.2 requires documentation of education, training, skills, and experience.
Medical device manufacturers are now being audited against ISO 13485 training requirements, but the question remains: Is your organization ready?
It’s important to consider how the term “competent” is used by ISO. Many companies (and auditors) may assume that competence requires some form of testing or examination, but it can also be demonstrated by a person’s overall education and experience. If an auditor or investigator asks how competence is demonstrated, the company should be able to produce training procedures to explain how the company establishes competence based on job function. Further, the company needs to be prepared to present a variety of records demonstrating employee education, experience, background, and skill, as well as any special training that may be contained in personnel files, a learning management system, or other HR repository.
ISO goes beyond just requiring competence in the expectation that competence is “maintained.” Providing employees with opportunities for retraining is important, and for those in managerial roles, expanding their knowledge by attending seminars or conferences that afford unique training opportunities isn’t only a way to maintain competence but also helps demonstrate a Culture of Quality, where employees are given opportunity for growth and advancement.
Key areas to consider for demonstrating compliance with training requirements include:
- Make sure that functional job descriptions (especially for those in roles making decisions that affect quality) state the competency requirements. This can be in the “education and experience” requirements section of a job description.
- Make sure training procedures define and explain competency and how it is intended to be demonstrated and maintained. Clarify what constitutes competency and how this is maintained for personnel with different levels of responsibility.
- Be prepared to show elements of the personnel files that demonstrate competency.
- Establish ongoing training plans and annual personnel objectives. For those in managerial roles where important quality decisions are routinely made, this should include opportunities for enhanced education.
- Apply a risk-based approach when establishing training requirements. The higher the risk a job has as it relates to product quality (and, ultimately, patient safety), the more rigorous requirements should be for establishing and maintaining competency.
- Prepare HR personnel to be interviewed and to present objective evidence during regulatory inspections.
- Establish, within procedures, a variety of means for demonstrating effectiveness of training.
- Include defect awareness and discrete quality objectives within manufacturing work instructions and emphasize these during documented operator training.
- Understand how training, training opportunities, and ongoing employee knowledge enhancement supports a Culture of Quality.
Parting Thoughts
Training requirements for the US medical device industry has evolved with the transition from the Quality System Regulation to the ISO 13485-aligned Quality Management System Regulation. How the FDA embraces and evaluates ISO 13485 requirements for training will impact the frequency and types of FDA-483 inspectional observations, which is yet to be determined from actual inspectional experience.
Deploying more of the ISO 13485 “systems” approach with training programs will improve upon the job-specific training focus of 21CFR, Part 820. Well-defined methods for demonstrating training effectiveness and documentation of personnel qualifications should also help bolster employee competence aligned with quality objectives. Fully understanding and successfully implementing the ISO 13485 training requirements will put manufacturers on a path to fewer product and quality system problems.
Medical device manufacturers are now being audited against ISO 13485 training requirements, but the question remains: Is your organization ready?
