Understanding the differences between 21 CFR 820.50 and ISO 13485 Clause 7.4.
Comparison of QSR and QMSR requirements for Purchasing Controls
Starting on February 2, 2026, most medical device companies who sell their devices in the United States must comply with FDA’s new Quality Management System Regulation (QMSR, 21 CFR 820), which on that day will replace the current Quality System Regulation (QSR, 21 CFR 820). In addition, from February 2 forward, medical device organizations must comply with ISO 13485 – Medical devices – Quality management systems.
The transition from the QSR to the QMSR introduces key changes that impact how medical device manufacturers manage purchasing controls.
Under the current QSR, purchasing controls primarily focus on ensuring suppliers, contractors, and consultants comply with specified requirements through evaluations, agreements, and monitoring.
The QMSR, however, aligns more closely with ISO 13485 Clause 7.4, emphasizing a risk-based approach to supplier management and requiring manufacturers to consider the potential impact of purchased products and services on the safety and performance of medical devices.
An FDA QSR-to-QMSR cross-reference chart shows that Subpart E, Purchasing Controls, will be integrated into ISO 13485 Clause 7, Product Realization. The chart states that FDA considers the requirements to be “substantively similar.”
Something to be aware of, and this is true for other Subparts integrated into the ISO standard, that to FDA it means that all the current QSR purchasing controls can fit into the ISO 14485 framework. And this is true. However, ISO 13485 has additional requirements for those controls that you will need to consider, design, evaluate and implement into your QMSR-compliant quality system.
For purchasing controls, the current requirements of ensuring received products and services comply with specific requirements, evaluation of suppliers, contractors, and consultants, and generating and maintaining purchasing data are all in the standard.
For the MDSR, in addition to establishing and maintaining requirements for suppliers, contractors and consultants (suppliers), documenting the evaluation and selection of providers, and establishing and maintaining records of those who are acceptable, the QMSR includes the following requirements:
- Supplier evaluation will also be based on a risk-based assessment of the impact of the purchased product on the quality of the medical device, which should be proportionate to the risk associated with the device.
- In addition to selecting suppliers in accordance with established criteria, you must plan and monitor suppliers and document the results of the monitoring.
- Documentation for monitoring must then be used as input to the supplier re-evaluation process you must design and implement.
- Purchasing requirements that are not fulfilled must be addressed directly with the supplier, in accordance with the risk associated with the purchased product and compliance with regulatory requirements.
- Maintain records of the evaluation, selection, monitoring, and re-evaluation of supplier capability
There are also additional requirements for purchasing information (currently known as purchasing data). In addition to the current requirements to establish and maintain data that describe (or reference) specified requirements and including, where possible, document on purchasing documentation a requirement for the vendor to notify you of changes to their product or service, QMSR will have the following additional requirements:
- In addition to product specifications, purchase documentation must include product acceptance procedures, processes, and equipment, requirements for the qualification of supplier personnel, and quality management system requirements, and
- Maintain relevant purchasing documents as required for traceability in Clause 7.5.9, as well as requirements for documentation (Clause 4.2.4) and records (Clause 4.2.5).
In addition to the clause cross-references mentioned, sections regarding verification of purchased product will connect with Clause 8, Measurement, Analysis, and Improvement. Verification activities must be based on supplier evaluation results, in proportion with the risks of the purchased product, and related documentation maintained.
QMSR Frequently Asked Questions
Although the FDA has done an excellent job of laying out QMSR requirements and explaining differences between the QSR and the QMSR, there are questions related to the implementation of the new Quality Management System Regulation (QMSR) that need an answer. This page...
And finally, if you or your supplier will perform verification at the supplier’s facility, the verification activities and product release process(es) must be included in the purchase documentation.
As you compare QSR and QMSR requirements for a given topic, it should be apparent that the transition from the QSR to the QMSR will require the establishment of the design, documentation, and implementation of new processes in addition to the maintenance of existing processes.
If you are not familiar with ISO 13485, we recommend that you work with a qualified consultant to determine requirements and establish a plan that will include the activities you can implement prior to February 2, 2026. Medical Devices and Pharma offers a review of quality documentation followed by a report that identifies current gaps and when they may be implemented. For more information, contact us.