QMSR Compliance for Small Device Companies (2026): What You Need in Place Now

On February 2, 2026, the FDA's new Quality Management System Regulation (QMSR) replaced the decades-old Quality System Regulation (QSR) as the quality-system rule for medical devices. If you make or plan to market a device in the U.S., the QMSR is now the standard your quality system is measured against — and for small companies still running on spreadsheets, shared drives, or an outgrown legacy system, the gap can be uncomfortable.

Here's a plain-English rundown of what changed, what it means for a small device company, and what you need in place.

What is the QMSR?

The QMSR is the FDA's updated version of 21 CFR Part 820. Its headline change: it incorporates ISO 13485:2016 by reference. Instead of maintaining a separate, U.S.-only set of quality-system requirements, Part 820 now points to the international standard most of the world already uses — with a handful of additional FDA-specific requirements layered on top (records, labeling, UDI, and linking complaint handling to medical device reporting).

The goal is harmonization: one quality system that satisfies both the FDA and ISO 13485, instead of maintaining two overlapping frameworks.

What actually changed

• ISO 13485:2016 is now the backbone. Your quality system must meet ISO 13485, plus the FDA's supplemental requirements.
• Terminology shifted. Familiar QSR terms give way to ISO language — the Device Master Record and Device History Record concepts map to the ISO "medical device file" and related records.
• Risk management is more explicit. ISO 13485 threads a risk-based approach through the entire quality system, not just design controls.
• The core disciplines are unchanged in spirit. Document control, CAPA, complaint handling, management review, and design controls are still central — just framed in ISO 13485 terms.

Importantly, the QMSR did not change 21 CFR Part 11. If your quality records and signatures are electronic, they still must meet Part 11's requirements for audit trails, electronic signatures, and record integrity.

What it means for a small device company

How much work you face depends on where you started:

• Already ISO 13485 certified? You're most of the way there — focus on the FDA's supplemental requirements and terminology.
• Following the old QSR only? More to do — aligning your quality manual, procedures, and records to ISO 13485.
• Running on paper or spreadsheets? The hardest spot. Manual systems make it hard to demonstrate the document control, traceability, and record integrity the QMSR (and Part 11) expect — and nearly impossible to scale.

For a small team without a full quality department, the challenge isn't understanding the regulation — it's finding the time to transition and stay compliant on top of everything else.

A practical QMSR readiness checklist

• Run a gap assessment — your current system vs. ISO 13485:2016 plus the FDA supplements.
• Update your quality manual and SOPs to ISO 13485 structure and terminology.
• Confirm your core processes hold up — document control, CAPA, complaints, risk management, design controls, management review.
• Fix records and traceability — every controlled record attributable, legible, and tamper-evident, with a clear who-did-what-when history.
• Meet Part 11 for electronic records — audit trails, electronic signatures, record integrity.
• Train your team on the updated procedures and terminology.
• Keep it maintained — QMSR compliance is an ongoing state, not a one-time project.

Where an eQMS helps

Most of the QMSR's expectations — controlled documents with full revision history, an immutable audit trail, electronic signatures, linked CAPA and complaint records, management-review metrics — are exactly what a purpose-built electronic quality management system (eQMS) is designed to do. The right eQMS turns "prove your quality system is compliant" into a byproduct of how you already work.

The catch has always been that established eQMS platforms were built for large manufacturers — expensive, heavy, slow to deploy. That's the gap Indelio was built to fill.

A right-sized, AI-native eQMS for small device companies

Indelio is a 21 CFR Part 11 / GAMP 5–compliant eQMS built specifically for small device and biotech teams: controlled documents, CAPA, complaints, nonconformances, change control, design controls, risk, training, suppliers, audits, and management review — with an immutable, hash-chained audit trail and two-component electronic signatures throughout. It ships with a pre-drafted validation package, so you're not starting IQ/OQ/PQ from a blank page.

We're onboarding three founding partners: the platform free for 60 days, onboarding passed through at cost, and the founding rate locked permanently on conversion. Everyone else gets a 30-day free trial. If you're a small device or biotech company working through QMSR compliance, a 20-minute look will tell you whether it fits.

This article is general information, not regulatory or legal advice. Always refer to the QMSR final rule and consult a qualified quality/regulatory professional for your specific situation.