QMSR Transition Plan: A 90-Day Roadmap for Medical Device Manufacturers

The Quality Management System Regulation (QMSR) is FDA’s medical-device quality-system regulation in 21 CFR Part 820. It incorporates ISO 13485:2016 by reference and retains FDA-specific requirements. A useful transition plan connects that regulatory framework to the work a manufacturer actually performs: development decisions, risk controls, supplier oversight, verification and validation, release and post-market feedback.

This 90-day roadmap is a suggested implementation and remediation sequence, not an FDA grace period. QMSR became effective February 2, 2026. Manufacturers with unresolved gaps must address applicable obligations now; they should not postpone necessary containment or patient-safety decisions until a planning milestone. The objective is a functioning, evidence-backed system—not a renamed procedure library.

Before day one: define the decision and the scope

Name an executive sponsor and an accountable quality lead. Document the covered devices, sites, activities and outsourced processes. Determine applicable requirements and any exclusions or exemptions with a justified rationale. An established manufacturer, a premarket software developer and a firm adding a connected-device service will not have identical evidence needs.

Choose one current device, one recent change and one complaint or nonconformity as diagnostic samples. For SaMD, select a released software version and a safety-relevant requirement. Ask whether the team can retrieve the requirement, associated hazard, risk control, test result and release approval without relying on one person’s memory. Our QMSR complete guide explains the broader evidence chain.

Days 1–30: establish a defensible baseline

Map existing processes to applicable requirements, including FDA-specific provisions. Review records rather than procedures alone. A procedure stating that suppliers are qualified does not demonstrate that a critical cloud provider has been evaluated, monitored and controlled for its role in the device.

Build a gap register with requirement references, sampled evidence, risk, owner and action. Distinguish absent controls from incomplete records, ineffective implementation and retrieval problems. Prioritize conditions that could affect device safety, product conformity or required reporting. Assign interim containment when warranted and record the decision; a future corrective action is not an adequate substitute for addressing an immediate risk.

For an AI-enabled device, include data and software interfaces: approved model version, intended use, validation population, configuration, deployment environment and change assessment. Keep quality-system remediation separate from whether a device change requires a new submission. Both decisions may be necessary, but one does not resolve the other.

Days 31–60: close priority gaps through actual work

Select a manageable set of high-priority corrections and implement them in operating processes. Update responsibilities, training and acceptance criteria before expecting new forms to produce better evidence. Where a corrective action is warranted, investigate causes and define how effectiveness will be checked.

For example, missing test traceability may originate in requirements changing after test planning. The remedy could require a controlled review gate, change-impact assessment and updated test coverage—not merely a retrospective spreadsheet. Record corrections transparently. Do not recreate historical approvals as if they existed at the time or erase deviations from the record.

Review critical suppliers and outsourced activities with the same discipline. Define the supplied service, relevant risks, purchasing requirements, acceptance evidence and monitoring responsibilities. For a digital-health application, that may include a software component supplier, hosting service or external testing laboratory. Read our ISO 13485–QMSR gap analysis to separate incorporated requirements from additional US obligations.

Days 61–90: verify effectiveness and rehearse retrieval

Sample newly generated records to determine whether the implemented controls work. Check that assigned owners follow the process, evidence is approved and changes propagate through linked records. Completion of training or issuance of a procedure can support implementation, but neither alone establishes effectiveness.

Run a focused internal review and a realistic retrieval exercise. Ask a colleague outside the project to follow a release decision back to requirements, risk assessment, V&V results and supplier evidence. Then follow a complaint forward to investigation, reportability assessment and any necessary action. The purpose is to uncover broken interfaces before an external investigator does.

Bring unresolved risks, resources and effectiveness results to the appropriate management review. Maintain a credible plan for work extending beyond day 90. Some validation or long-term effectiveness activities cannot responsibly be compressed into this window; specify milestones and controls rather than declaring premature closure.

An actionable 90-day implementation table

Use the dates as planning targets, not regulatory deadlines. The six QMS areas inspection guide helps organize samples across connected processes instead of over-investing in one comfortable area.

Download the implementation roadmap

Download the QMSR 90-Day Implementation Roadmap.xlsx. The editable workbook includes suggested workstreams, owners, evidence references, target periods, status and effectiveness fields. Replace suggested roles and timing with your actual organization and risk priorities.

The worksheet is a preparation aid, not an FDA form or certification tool. Keep sensitive device and patient information in appropriately controlled systems; use references rather than copying unnecessary confidential material into a planning file. An action is not closed simply because its cell changes color: attach or reference evidence supporting the decision.

A weekly review should distinguish overdue actions, blocked dependencies and genuinely verified closure. Escalate missing resources to the sponsor, and record why priorities change. This keeps the roadmap accountable without rewarding superficial completion. Where an action depends on an external supplier or longer validation study, retain interim controls and explicit evidence milestones rather than hiding the dependency in a general status note.

Make the system sustainable after day 90

Build continuing controls into normal release, supplier and feedback workflows. Monitor whether changes are assessed before deployment, whether evidence remains accessible and whether repeat issues indicate an ineffective correction. Integrate electronic-record controls where applicable; the Part 11 and electronic records guide helps distinguish trustworthy records from unassessed software workflows.

MedTech Copilot supports organizing fragmented development, quality, risk, V&V and regulatory work into structured, evidence-backed outputs for expert review. Use it to develop a defensible task and evidence structure—not to replace accountable approvals or claim guaranteed compliance.

FDA primary sources

• FDA QMSR overview: effective date and regulatory transition.
• FDA’s QMSR final rule, official Federal Register publication: incorporation of ISO 13485 and FDA-specific provisions.
• FDA Compliance Program 7382.850: inspection framework and applicable requirements.