The U.S. Food and Drug Administration (FDA) regulates firms involved in manufacturing, repackaging, relabeling, importing, and distributing medical devices. Depending on the device and business activity, requirements can include establishment registration, device listing, premarket requirements, quality management, labeling, records, reporting, and postmarket controls.

Compliance planning is therefore broader than maintaining a single set of documents. Organizations generally need processes that connect product development, risk management, manufacturing, supplier controls, documentation, complaints, corrective actions, and regulatory reporting.

Medical Device Regulatory Documentation

Regulatory documentation provides evidence that a device and the processes used to produce it meet applicable requirements.

Depending on the device and regulatory pathway, documentation may include:

• Device descriptions

• Intended-use information

• Risk-management records

• Design documentation

• Testing records

• Manufacturing procedures

• Labeling information

• Supplier qualification records

• Quality records

• Complaint records

• Corrective and preventive-action documentation

• Medical Device Reporting records

• Premarket submission documentation

• Registration and listing information

The specific documentation required depends on the device classification, regulatory pathway, manufacturing activities, and applicable FDA requirements.

Document control is particularly important because outdated procedures or uncontrolled records can create inconsistencies between documented processes and actual operations.

FDA Quality Management System Regulation

A major recent development for U.S. medical device manufacturers is the FDA's Quality Management System Regulation (QMSR).

The QMSR became effective on February 2, 2026, amending 21 CFR Part 820 and incorporating by reference ISO 13485:2016, the international standard for medical device quality management systems.

The QMSR applies to finished device manufacturers intending to commercially distribute medical devices.

The change is intended to harmonize the FDA's quality-system framework more closely with international medical-device quality-management practices.

For manufacturers, this means compliance planning should consider both the requirements of the QMSR and the applicable incorporated ISO 13485 provisions.

Quality Management Systems

A quality management system, or QMS, establishes documented processes for controlling product quality and related business activities.

Important QMS areas can include:

Management responsibility
Leadership establishes quality objectives, responsibilities, resources, and oversight.

Document and record control
Organizations maintain controlled procedures and appropriate records demonstrating that processes were performed as required.

Design and development
Product-development activities should be planned, documented, reviewed, and controlled according to applicable requirements.

Supplier controls
Organizations evaluate and monitor suppliers whose products or processes can affect device quality.

Production controls
Manufacturing processes should be defined and controlled to support consistent device production.

Corrective and preventive processes
Quality problems are investigated and addressed through appropriate corrective-action processes.

Risk management
Potential risks are identified, evaluated, controlled, and monitored throughout the product lifecycle.

Device Classification and Regulatory Pathways

Medical devices are subject to different regulatory requirements depending on their classification and characteristics.

FDA generally categorizes devices into Class I, Class II, and Class III based on risk and the level of regulatory control needed.

Potential regulatory pathways can include:

• Exemption from premarket submission in applicable circumstances

• 510(k) premarket notification

• De Novo classification

• Premarket approval (PMA)

• Humanitarian Device Exemption (HDE)

• Investigational Device Exemption (IDE) for applicable clinical investigations

Not every device follows the same pathway. Manufacturers should identify the applicable product classification and regulatory requirements before commercial distribution.

FDA explains that device regulation includes general controls, establishment registration, device listing, premarket requirements, labeling, records and reports, and quality-management requirements.

FDA Establishment Registration and Device Listing

FDA establishment registration and device listing are important parts of U.S. medical device compliance.

FDA states that manufacturers, including foreign manufacturers, and initial distributors or importers of medical devices generally have registration obligations under 21 CFR Part 807. Foreign manufacturers must also designate a U.S. Agent.

Establishments generally must also list applicable devices with FDA and identify relevant activities performed on those devices. If a device requires premarket authorization or clearance, the applicable submission information is associated with the device listing.

Registration information is submitted electronically unless FDA has granted an applicable waiver. FDA also requires annual verification of registration information during the designated annual period.

Risk Management and Product Safety

Risk management is an important part of medical device quality planning.

Organizations may evaluate risks associated with:

• Intended use

• Foreseeable misuse

• Device design

• Materials

• Software

• Electrical components

• Manufacturing processes

• Packaging

• Sterilization

• Labeling

• Transportation

• Installation

• Maintenance

• Postmarket use

Risk controls should be incorporated into appropriate design and production processes and documented according to the applicable quality system.

FDA held a QMSR town hall in January 2026 specifically addressing risk management, risk-based decisions, and design and development under the new framework.

Supplier and Manufacturing Controls

Medical device manufacturers may depend on external suppliers for components, materials, software, packaging, sterilization, testing, or other production activities.

Supplier controls can include:

• Supplier qualification

• Technical specifications

• Quality agreements

• Incoming inspection

• Supplier performance monitoring

• Change notification

• Corrective-action processes

• Periodic supplier review

The level of oversight should reflect the potential impact of a supplier's product or process on device quality and safety.

A structured supplier-management process can also help maintain traceability when components, materials, or manufacturing processes change.

Complaints, Reporting, and Postmarket Monitoring

Compliance continues after a device enters commercial distribution.

Organizations may need processes for:

• Complaint handling

• Product investigations

• Medical Device Reporting

• Corrections and removals

• Recalls

• Trend analysis

• Field performance monitoring

• Corrective actions

Postmarket information can identify problems that were not apparent during product development or initial production.

An effective complaint system should allow relevant information to move into quality investigations and, when appropriate, regulatory reporting or corrective-action processes.

2026 QMSR Inspection Changes

The QMSR introduced an important change to FDA inspection practices.

Beginning February 2, 2026, FDA stopped using the former Quality System Inspection Technique (QSIT) for medical device inspections and began using the inspection process described in Compliance Program 7382.850.

FDA's QMSR guidance states that investigators may review records that form part of the manufacturer's quality-management system, including certain records created before February 2, 2026.

FDA also states that management review, quality audit, and supplier-audit records may be available for inspection under the QMSR.

Manufacturers should therefore maintain organized records that demonstrate how their quality system operates in practice.

Compliance Planning and Internal Reviews

A compliance program can benefit from periodic internal reviews rather than relying only on preparation immediately before an FDA inspection.

A review may examine:

• Registration status

• Device listings

• Premarket documentation

• Quality-system procedures

• Training records

• Supplier controls

• Design records

• Manufacturing records

• Complaint files

• Corrective actions

• Audit records

• Management reviews

• Postmarket reporting

• Document-control practices

Organizations can compare current procedures with applicable QMSR requirements and identify gaps that require additional documentation, training, process changes, or management attention.

Recent Regulatory Developments

The most significant recent development is the February 2, 2026 implementation of the QMSR.

FDA describes the regulation as an amendment to 21 CFR Part 820 that incorporates ISO 13485:2016 by reference.

FDA also conducted industry education during 2026, including an April 1, 2026 town hall addressing the new QMSR risk-based inspection approach.

The FDA's updated compliance program now provides the framework for medical device manufacturer inspections under the QMSR.

For manufacturers, the practical focus is on maintaining a functioning quality system, appropriate records, risk-based processes, and evidence demonstrating compliance with applicable requirements.

Tools and Resources

Useful U.S. resources for medical device compliance include:

• FDA Quality Management System Regulation (QMSR) — current information about 21 CFR Part 820 and its relationship with ISO 13485:2016.

• FDA Quality and Compliance for Medical Devices — quality-system and inspection information.

• FDA Device Registration and Listing — establishment registration and device-listing requirements.

• FDA CDRH Compliance Programs — information about the current medical-device inspection framework.

• FDA General Controls — overview of major medical-device regulatory controls.

• FDA Registration and Listing Database — information that can be searched by establishment and device-related fields.

FAQs

1. What is medical device compliance?

Medical device compliance involves meeting applicable regulatory, quality, documentation, manufacturing, labeling, reporting, and postmarket requirements for a medical device.

2. What is the FDA QMSR?

The Quality Management System Regulation is the FDA's updated quality-management framework for applicable medical device manufacturers. It became effective February 2, 2026, and incorporates ISO 13485:2016 by reference.

3. Do medical device manufacturers need FDA registration?

Many establishments involved in manufacturing or distributing medical devices intended for the U.S. market have FDA registration and device-listing obligations. Requirements vary according to establishment type and activity.

4. What records can FDA review during a QMSR inspection?

FDA investigators may review records that are part of the manufacturer's quality-management system. FDA specifically states that management review, quality-audit, and supplier-audit records can be subject to inspection under the QMSR.

5. Why is ISO 13485 important for U.S. medical device manufacturers?

ISO 13485:2016 is incorporated by reference into the FDA's QMSR. This creates closer alignment between the U.S. medical device quality framework and the international quality-management standard.

Conclusion

Medical device compliance combines regulatory documentation, quality management, product risk controls, manufacturing processes, supplier oversight, registration, device listing, postmarket monitoring, and regulatory reporting.

For U.S. manufacturers, the February 2, 2026 implementation of the QMSR represents an important change in the quality-system and inspection framework. The incorporation of ISO 13485:2016 and the updated FDA inspection process make organized quality records and risk-based compliance planning particularly important.

Organizations should evaluate their specific device classification, regulatory pathway, manufacturing activities, and applicable FDA requirements rather than applying one compliance process to every type of medical device.