Perhaps one of the more distinct aspects for medical device manufacturers when it comes to switching from the US Food and Drug Administration’s (FDA) current Quality System Regulation (QSR) to the new Quality Management System Regulation (QMSR) is that Design Controls will be replaced by Design and Development activities come Feb. 2.
The QMSR harmonizes the current decades-old QSR with international quality systems standard ISO 13485:2016. The FDA published its new rule in 2024. (Related Stories: “Risk Management & QMSR: 7 Questions Answered By FDA,” QualityHub, Jan. 15, 2026, and “QMSR: FDA Answers 21 Burning Questions From MedTechs,” QualityHub, Jan. 2, 2026.)
During an FDA Town Hall webinar on Jan. 14, these four agency officials answered a handful of questions from industry around the new Design and Development requirements:
- Tonya Wilbon
- Assistant Director for Post-Market Industry, Education and Consumer Education, Division of Industry and Consumer Education (DICE)
- Karen Masley-Joseph
- Senior Advisor, Office of Medical Devices & Radiological Health Inspectorate, Office of Inspections and Investigations (OII)
- Keisha Thomas
- Associate Director for Compliance & Quality, Office of Product Evaluation and Quality (OPEQ)
- Kimberly Lewandowski-Walker
- Regulatory Officer, FDA Inspections and Regulatory Audits Team, Office of Regulatory Programs, Office of Product Evaluation and Quality (OPEQ)
[Editor’s Note: The questions and answers below were lightly edited by QualityHub for clarity and brevity.]
No. 1: What are the requirements of ISO 13485 for who does design reviews? And is it accurate that there is no requirement for an independent reviewer at each stage in the QMSR?
Tonya Wilbon: Clause 7.3.5 of ISO 13485 requires design reviews to include representatives of functions concerned with the Design and Development stage being reviewed as well as other specialty personnel, but does not explicitly require independent reviewers. ISO 13485 also provides adequate flexibility for organizations to balance personnel resources while ensuring effective independent review. The agency expects manufacturers to include appropriate personnel who can provide meaningful oversight of the design process.
No. 2: Does a contract manufacturer that meets the definition of a manufacturer and is not responsible for medical device Design and Development need to maintain risk management documentation under the QMSR?
Karen Masley-Joseph: A contract manufacturer that meets the definition of a manufacturer is required to maintain risk management documentation as set forth in ISO 13485, Clause 7.1, Planning of Product Realization. Clause 7.1 requires manufacturers – including contract manufacturers that meet the definition of a manufacturer – to document one or more processes for risk management and product realization and to maintain records of risk management activities regardless of whether they are responsible or not for Design and Development.
While a contract manufacturer is not explicitly required to maintain complete copies of the finished device manufacturer’s risk management files, they must have sufficient information to fulfill their own risk management obligations under the QMSR. That kind of documentation between the finished device manufacturer and the contract manufacturer … should establish each entity’s risk management responsibilities.
No. 3: Is an unclassified pre-amendment device exempt from Design and Development requirements in the QMSR?
Keisha Thomas: An unclassified pre-amendment device is not automatically exempt from Design and Development requirements. Unclassified devices are generally subject to Design and Development requirements if it meets the device descriptions listed in 820.10(c) and the changes have been made to devices marketed before October 1997. Manufacturers should be very careful in making sure they evaluate whether Design and Development requirements apply to their specific situation and their specific device.
No. 4: If the finished device includes software, does the QMSR require the manufacturer to validate that software?
KMJ: Yes, the QMSR requires that the finished device and its software be validated for its intended use, and those requirements are set forth in ISO 13485, including in Clause 7.3. And I [want to] reiterate that device software validation does require a comprehensive approach that .. includes planning, verification, testing, traceability, configuration management, and other good software engineering practices.
No. 5: Are US initial importers or initial distributors of finished medical devices from a foreign manufacturer that do not perform design or manufacturing required to comply with Quality Management System elements such as Design and Development?
TW: In general, [Design and Development] is applied to manufacturers of finished devices. These manufacturers are subject to those requirements that are applicable to the operations and the activities being performed at their establishment. This means organizations must implement only those Quality Management System elements that correspond to the activities that are being performed at their facility.
So, initial importers and distributors that do not perform Design and Development activities are not required to comply with Design and Development requirements. However, [they] will be required to comply with other regulatory obligations such as complaint handling, Medical Device Reporting [MDR], maintenance of distribution records, device traceability requirements where applicable, and coordination with foreign manufacturers for device corrections and corrective actions as required.
No. 6: How will designs that are developed under the previous 21 CFR, Part 820 regulation be evaluated by the FDA?
Kimberly Lewandowski-Walker: [The FDA recognizes] that there are many devices that have been designed under the 1996 Quality System Regulation requirements, but those design files will be reviewed during FDA inspections conducted after Feb. 2, 2026. Now, we know the requirements of ISO 13485:2016, the Quality Management System Regulation, and the 1996 Quality System Regulation are substantively similar, so the FDA does not expect organizations to retroactively reference the ISO 13485 standard in pre-Feb. 2, 2026, Design and Development files. Nor do we expect organizations to scrub those files – for lack of a better term – for specific 1996 QSR terms such as Design History File. [However, the FDA does] encourage manufacturers to conduct a gap analysis of their pre-Feb. 2, 2026, designs that are marketed after Feb. 2, 2026, to ensure that the requirements of the ISO 13485 standard are met.
No. 7: Does the FDA expect or require the Design and Development file to be continually updated for the life of the device?
KLW: Yes. When changes are made throughout the life of the device, records are required to be maintained in accordance with ISO 13485, Subclause 7.3.9, which is control of Design and Development changes. These records can either be included in the Design and Development file or maintained elsewhere, for example, as part of change control records.
