For a medical device company with no prior quality management infrastructure, expect 12 to 18 months from project kickoff to a successful certification audit. For a company with an existing quality system that needs to be updated and formalized, the timeline can compress to 6 to 9 months. Companies with a mature, documented QMS that are simply transferring to a different certification body sometimes complete the process in 4 to 6 months.

This article breaks down each phase of the certification timeline, identifies the variables that compress or extend it, and explains what you can do to avoid the delays that push most first-time certifications past their original deadline.

What ISO 13485 certification actually involves

ISO 13485 is a quality management standard published by the International Organization for Standardization (ISO). It specifies requirements for organizations involved in the design, development, production, installation, or servicing of medical devices and related services. Certification means a notified body or accredited certification body has audited your quality management system and confirmed it meets the standard’s requirements.

Certification is not a product approval. It is a certification of your quality system. A company can hold ISO 13485 certification and still have individual product submissions or regulatory approvals pending. Under FDA’s Quality Management System Regulation (QMSR), which aligns with ISO 13485, FDA accepts a certificate of conformance to ISO 13485 as evidence of QMS compliance, making ISO 13485 certification directly relevant to FDA market access as well (FDA, 2026).

Phase 1: Gap analysis (4 to 8 weeks)

The first phase is a structured comparison of your current quality practices against every clause of ISO 13485:2016. The goal is to identify which requirements you already satisfy, which you partially satisfy, and which you do not address at all.

A gap analysis covers all seven sections of the standard: the quality management system itself (Section 4), management responsibility (Section 5), resource management (Section 6), product realization (Section 7), and measurement, analysis, and improvement (Section 8). Each subsection maps to specific documented procedures, records, and activities that the auditor will expect to find during certification.

The output of a gap analysis is a prioritized remediation plan. Every gap becomes a project task with an owner and a target completion date. Without this step, organizations often discover late in the process that a foundational element, such as a management review procedure or a design controls framework, is missing or too informal to satisfy an auditor.

Phase 2: QMS documentation development (8 to 16 weeks)

Documentation is the most time-consuming phase, and it is where most timelines slip. ISO 13485 requires a quality manual, a documented quality policy, quality objectives, and documented procedures for a defined set of core processes including document control, record control, internal audit, CAPA, nonconformance management, and management review.

Beyond those mandatory documents, most regulated medical device companies need documented procedures for design controls, risk management (ISO 14971), validation, supplier qualification, and complaint handling. Each procedure needs to be written, reviewed by subject matter experts, approved through a formal document control process, and trained to the affected employees before the certification audit.

The time required for this phase depends almost entirely on how much documentation already exists. A company that has been operating informally can adapt existing practices into documented procedures in eight to ten weeks. A company building from a completely blank page may need four months.

One variable that compresses this phase significantly is the quality management platform you use. A pre-validated eQMS like Cloudtheapp includes ready-to-deploy document templates, workflow-based approval routing, and built-in electronic signature capabilities that eliminate the manual coordination normally required to write, review, approve, and distribute controlled documents. The 60+ applications in the Cloudtheapp Store include dedicated modules for document control, CAPA, and risk management that are already configured to the ISO 13485 process structure, which shortens development time considerably.

Phase 3: Implementation and records generation (8 to 12 weeks)

Once documentation exists, the organization needs to actually run its quality system long enough to generate the records an auditor will review. This is a critical timeline driver that many companies underestimate. An auditor conducting a Stage 2 certification audit expects to see evidence that the QMS has been operating, not just documented.

At minimum, the auditor will look for completed internal audits covering the full scope of the QMS, at least one management review with documented inputs and outputs, active CAPA records showing how the organization identifies and responds to quality problems, and training records showing that employees have been trained to the procedures they are expected to follow.

Most certification bodies recommend running the QMS for a minimum of three months before the Stage 2 audit. This does not mean three months of perfect compliance. It means three months of documented activity, including records of issues found and addressed. Auditors are more comfortable with a company that identified nonconformances and corrected them than with a company whose records show no quality problems whatsoever.

Phase 4: Stage 1 audit (1 to 2 weeks)

The Stage 1 audit is a document review and readiness assessment conducted by the certification body before the full audit. The auditor reviews your quality manual, key procedures, and the overall structure of your QMS to determine whether you are ready for the Stage 2 audit.

Stage 1 findings typically take the form of observations or minor nonconformances rather than major findings that stop the certification process. Companies that complete a thorough gap analysis and follow through on all remediation tasks before Stage 1 rarely receive findings that require more than two to four weeks of correction. The Stage 1 report also gives you specific guidance on what the Stage 2 auditor will focus on, which is useful for preparation.

The gap between Stage 1 and Stage 2 is typically four to eight weeks, depending on the certification body’s scheduling and the number of Stage 1 findings that need to be addressed.

Phase 5: Stage 2 audit (2 to 5 days on-site)

The Stage 2 audit is the certification audit. The auditor visits your facility (or conducts a remote audit for specific scope elements), reviews your records, interviews employees, and assesses whether your quality system is both documented and effective in practice.

Minor nonconformances found during Stage 2 typically require a corrective action plan submitted within 30 to 60 days of the audit. Major nonconformances can delay certification until the root cause is resolved and the correction verified. Most organizations that complete Phase 1 through Phase 3 thoroughly receive only minor findings at Stage 2.

After the Stage 2 audit, the certification body’s technical review committee assesses the auditor’s report. Certificate issuance typically follows within two to four weeks of the audit.

What extends the timeline

Several factors reliably push ISO 13485 certifications past their original target dates.

Design controls complexity is the most common. Companies with active product development pipelines face the challenge of documenting design control procedures that satisfy ISO 13485 Clause 7.3 while managing ongoing design activities. Design history files, design input and output documentation, and design verification and validation records all need to be in order before a Stage 2 audit.

Supplier qualification depth is the second most common delay factor. ISO 13485 Clause 7.4 requires a defined process for evaluating and re-evaluating suppliers based on their ability to meet specified requirements. Companies with large or complex supply chains sometimes discover during gap analysis that their supplier files are incomplete and need significant work before an audit.

Management availability for approvals and the management review is a recurring bottleneck in smaller companies where senior leaders wear multiple hats. The management review procedure, the quality policy approval, and key procedure sign-offs all require executive involvement, and those activities tend to get scheduled around other priorities until they create a timeline problem.

What compresses the timeline

Using a pre-validated, ISO 13485-aligned eQMS from the start of the project removes the validation work from the certification project itself. Cloudtheapp provides a complete validation package with each platform release, which means the system is ready for use in your quality system from Day 1 without a separate computer system validation project running in parallel.

Working with a certification body early also compresses the timeline. Certification body schedules are often booked three to four months in advance. Selecting your certification body and booking the Stage 1 audit date during Phase 2 of documentation development ensures the audit schedule aligns with your readiness rather than creating a delay at the end of the project.

Prior ISO 9001 certification, while not equivalent to ISO 13485, provides a quality management foundation that reduces the documentation development effort. Companies with ISO 9001 typically find that Sections 4, 5, 6, 7.1, and 8 of ISO 13485 require modest adaptation rather than complete development.

Maintenance after certification

ISO 13485 certification requires ongoing surveillance audits. Certification bodies conduct annual surveillance audits in years one and two after initial certification, with a full re-certification audit in year three. Surveillance audits typically take one to two days and focus on a rotating set of QMS elements rather than a comprehensive review of everything.

The quality system needs to stay active between audits. Management reviews, internal audit findings, CAPA records, and training records all need to continue accumulating at planned intervals. A quality system that operates well enough to achieve certification but then goes quiet until the next audit will fail its first surveillance audit.

Starting your ISO 13485 certification project

Cloudtheapp supports medical device companies at every stage of the ISO 13485 certification process, from initial gap analysis through ongoing surveillance audit maintenance. The platform’s document control, CAPA, internal audit, training management, and supplier qualification modules are aligned to ISO 13485 requirements, and the pre-validated compliance package means your eQMS does not add to your certification project scope.

To see how Cloudtheapp accelerates ISO 13485 certification for medical device companies at your stage of development, request a demo with a quality systems specialist.

This post created by and appeared first on Cloudtheapp

The structure changed significantly while the underlying compliance obligations largely stayed intact. Here is what your quality team needs to understand.

What is 21 CFR Part 820?

21 CFR Part 820 is the section of the Code of Federal Regulations that establishes the minimum current good manufacturing practice (cGMP) requirements for the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished medical devices sold in the United States. The original Quality System Regulation (QSR) under Part 820 went into effect on December 18, 1978, and was last substantively updated in 1996.

For roughly 28 years before the QMSR transition, the QSR operated as a standalone FDA framework, separate from international standards like ISO 13485. That gap between US and global requirements created a dual-compliance burden for manufacturers selling into both US and international markets.

What is the QMSR?

The QMSR (Quality Management System Regulation) is the revised version of 21 CFR Part 820, published by FDA on February 2, 2024, in the Federal Register, with a two-year compliance window that ended February 2, 2026.

The QMSR's central change is that it incorporates ISO 13485:2016 by reference as the core compliance framework. Rather than maintaining a separate FDA-specific quality system standard, the QMSR treats ISO 13485 as the baseline, with FDA supplemental requirements layered on top. According to FDA's QMSR FAQ page, the agency made conforming edits to 21 CFR Part 4 as well to address combination product oversight.

What changed: the major differences

Structure and framework

The legacy QSR was a standalone document with its own clause structure, definitions, and requirements. The QMSR replaced that structure with ISO 13485:2016 as the incorporated standard, meaning manufacturers now work within an internationally recognized framework rather than a purely FDA-specific one.

For manufacturers already certified to ISO 13485, this simplifies dual compliance significantly. The two frameworks address the same quality system domains but used different terminology and clause numbering. QMSR eliminates much of that redundancy.

Terminology and definitions

The old QSR used terms like "finished device," "quality audit," and "quality system record" in ways that did not always map cleanly to ISO 13485 vocabulary. The QMSR aligns terminology with ISO 13485, which means quality system documentation may need updates to reflect current regulatory language.

According to the Federal Register final rule, FDA received comments recommending full alignment of definitions with ISO 13485, and the agency made significant adjustments in response.

FDA supplemental requirements

Even though ISO 13485 is now the core, FDA retained supplemental requirements that go beyond the international standard. These include requirements specific to complaint files and Medical Device Reports (MDRs), Unique Device Identifier (UDI) integration requirements, provisions addressing combination products under 21 CFR Part 4, and specific requirements for software validation tied to FDA's Computer Software Assurance (CSA) framework.

The NSF analysis of QMSR notes that QMSR makes ISO 13485:2016 "the core set of requirements," with FDA additions that enhance or clarify the international standard rather than replace it.

Design controls

Design controls remain mandatory under QMSR, but the requirements now flow through ISO 13485 Section 7.3. The substantive obligations are similar to the old 21 CFR 820.30 design control requirements, but the structure and documentation expectations reflect ISO 13485 conventions.

Risk management

The QMSR places greater emphasis on risk management by aligning with ISO 13485's risk-based approach. Manufacturers should ensure their risk register and associated risk management documentation meet ISO 14971 integration requirements, which are referenced in ISO 13485 and by extension in QMSR.

What stayed the same

The core compliance obligations that FDA has enforced for decades remain in place.

Document control remains required: all quality system documentation must be reviewed, approved, and controlled. The process does not change materially, though the clause references update to ISO 13485 numbering.

CAPA requirements carry forward. FDA inspectors continue to scrutinize CAPA programs closely, and the expectation for thorough root cause investigation remains unchanged.

Complaint handling persists: manufacturers must still maintain complaint files and evaluate each complaint for potential reportability as an MDR. The threshold for determining reportability has not changed.

Audits of the quality system remain required. The audit trail requirements for electronic records under 21 CFR Part 11 also remain in effect.

Supplier qualification and management requirements persist. The QMSR continues to require that manufacturers evaluate and select suppliers capable of meeting quality requirements.

Records retention timeframes and requirements carry over with limited modification.

What QMSR means for companies already certified to ISO 13485

For manufacturers who hold ISO 13485:2016 certification, the transition to QMSR compliance is primarily about understanding where FDA's supplemental requirements go beyond the international standard and ensuring those gaps are addressed in your quality system.

The Morgan Lewis QMSR readiness guide from October 2024 identified the key areas requiring attention as: MDR-specific complaint file requirements, UDI integration in records, software validation under CSA guidance, and combination product-specific provisions.

If your ISO 13485 certification scope covers those areas and your procedures reflect current FDA expectations, the transition documentation burden is manageable.

What QMSR means for companies that relied only on the old QSR

Manufacturers who built their quality system around the legacy QSR without maintaining ISO 13485 alignment face a more significant gap analysis. The clause structure is different, the risk management expectations are deeper, and the terminology in procedures and records may need updating.

FDA's own FAQ confirms that manufacturers were expected to have full systems in place by February 2, 2026, and that inspectors will evaluate compliance against the new QMSR framework. An FDA Form 483 observation citing QMSR non-compliance carries the same weight as any other observation, and repeated findings can escalate to warning letters.

The practical gap analysis: where to start

A QMSR transition gap analysis typically covers five areas.

First, map existing procedures to QMSR/ISO 13485 clause numbers. Identify procedures that reference old QSR sections by number and update those references.

Second, confirm that risk management documentation meets ISO 14971 requirements as integrated into ISO 13485 Section 7.1.

Third, verify supplier qualification files reflect QMSR requirements for supplier evaluation and re-evaluation.

Fourth, confirm that your computer system validation approach aligns with FDA's CSA guidance, which applies under QMSR.

Fifth, ensure the complaint process clearly identifies the MDR reporting decision point and documents that determination in the complaint record.

How a modern QMS platform supports QMSR compliance

Maintaining QMSR compliance requires a quality system that connects CAPA, complaints, document control, supplier qualification, risk management, and audit management in a single traceable environment. Disconnected spreadsheets and paper-based systems make it difficult to demonstrate the integrated quality system FDA now expects.

Cloudtheapp's cloud-based QMS gives medical device manufacturers a pre-validated, FDA-compliant platform with 60+ applications covering every QMSR domain. The platform supports ISO 13485 alignment out of the box, with built-in audit trail functionality, automated CAPA workflows, and electronic records that meet 21 CFR Part 11 requirements.

If your quality system needs a structural update to support QMSR compliance, schedule a demo to see how Cloudtheapp can accelerate your transition.

Frequently asked questions

When did QMSR go into effect?

The QMSR became effective February 2, 2026. FDA published the final rule in the Federal Register on February 2, 2024.

Does QMSR replace 21 CFR Part 820?

The QMSR revises 21 CFR Part 820, rather than replacing the regulatory citation. Part 820 still exists as the regulatory address, but the content now incorporates ISO 13485:2016 by reference.

Do I need ISO 13485 certification to comply with QMSR?

Certification is not required. ISO 13485 certification demonstrates conformance but is not mandated by FDA. The QMSR requires compliance with the substance of ISO 13485, not the certification credential.

What happens during an FDA inspection under QMSR?

FDA inspectors will evaluate your quality system against QMSR requirements, which include ISO 13485 obligations plus FDA supplemental requirements. Inspectors may ask to see gap analysis documentation from the transition, particularly for companies that previously operated under the old QSR without ISO 13485 alignment.

How long does a QMSR gap analysis take?

The timeline depends on the size and complexity of your existing quality system. A manufacturer with an ISO 13485-aligned system may complete the gap analysis in weeks. A manufacturer rebuilding from a QSR-only baseline may need three to six months.

This post created by and appeared first on Cloudtheapp

This guide covers the standard’s core requirements, explains how to implement a risk management process that satisfies both FDA QMSR and EU MDR expectations, and identifies the most common gaps that appear during audits and inspections.

What ISO 14971 requires

ISO 14971:2019 applies to all phases of a medical device’s life: design, development, production, post-production, and eventual decommissioning. The standard requires manufacturers to:

• Establish a risk management plan for each device
• Identify hazards and hazardous situations associated with the device
• Estimate and evaluate the associated risks
• Implement risk controls
• Evaluate residual risk and the overall residual risk
• Maintain a risk management file
• Collect and review post-production information

The standard does not prescribe specific risk analysis methods. It requires that you use methods appropriate to the device and the nature of the hazards. FMEA, fault tree analysis (FTA), and hazard analysis are all common approaches used in practice.

The ISO 14971 risk management process, step by step

Step 1: Establish your risk management plan

For each device (or device family), you need a risk management plan that defines:

• The scope of the risk management activities
• Who is responsible for each activity
• The risk acceptability criteria your organization will apply
• How risk management activities will connect to your development process
• How post-production information will feed back into the risk management file

The risk acceptability criteria are often the most difficult part to establish. ISO 14971 requires you to apply a risk policy that defines acceptable and unacceptable risk levels, typically expressed as a risk matrix (severity x probability). Your criteria must be defensible and documented before the risk analysis begins.

Step 2: Conduct hazard identification

Hazard identification starts with the intended use of the device and works outward to all reasonably foreseeable misuse. Consider:

• Energy hazards (electrical, mechanical, thermal, radiation)
• Biological and chemical hazards
• Hazards from software failure or malfunction
• Hazards from use error, including user interface design issues
• Hazards from manufacturing variability
• Hazards from degradation over the device’s intended service life

ISO 14971 Annex C provides a checklist of example hazards organized by category. This is a useful starting point, not a complete list for any specific device.

Step 3: Estimate and evaluate risk

For each hazard and associated hazardous situation, estimate:

• Severity — the magnitude of potential harm if the hazardous situation leads to harm
• Probability of occurrence — how likely it is that the sequence of events from hazard to harm will occur

Risk is typically expressed as the combination of severity and probability. Each risk is then evaluated against your risk acceptability criteria to determine whether risk control measures are required.

Note: ISO 14971:2019 removed the concept of “broadly acceptable” risk from the 2007 version. Under the 2019 standard, all risks must be reduced as far as possible, even if they initially fall below the unacceptable threshold.

Step 4: Implement and verify risk controls

ISO 14971 specifies a hierarchy of risk controls that must be applied in order:

1. Inherent safety by design — eliminate or reduce the hazard through design changes
2. Protective measures — add safeguards in the device or the manufacturing process
3. Information for safety — address residual risks through labeling, warnings, and instructions for use

After implementing controls, you must verify that:

• The risk controls were actually implemented as designed
• The risk controls are effective (residual risk is at an acceptable level)
• The risk controls did not introduce new hazards

This last check is one area where risk analysis files frequently have gaps. A design change that eliminates one hazard may introduce a new electrical hazard or increase the complexity of the user interface. Each introduced hazard must be added to the analysis and evaluated.

Step 5: Evaluate overall residual risk

After all individual risks have been addressed, ISO 14971 requires an evaluation of the overall residual risk. The question is not just whether each individual risk is acceptable, but whether the combination of all residual risks is acceptable given the medical benefits of the device.

This evaluation must be documented and referenced against your risk acceptance criteria. For higher-risk devices, this often requires clinical data or published literature to support the benefit-risk conclusion.

Step 6: Maintain the risk management file

The risk”>https://www.cloudtheapp.com/glossary-risk-register/”>risk register and the full risk management file must be maintained and updated throughout the device’s lifecycle. This is not a documentation exercise that ends at design freeze.

Post-production information, including complaint data, post-market surveillance reports, adverse event reports, and changes in state-of-the-art knowledge, must feed back into the risk management process. If new hazards are identified post-market, the risk file must be updated and additional risk controls implemented if needed.

ISO 14971 and FDA QMSR

Under FDA’s QMSR regulation, which became effective February 2, 2026, risk management requirements align closely with ISO 13485:2016, which in turn requires compliance with ISO 14971 principles for risk management. If you hold ISO 13485 certification, your risk management process already needs to satisfy ISO 14971 requirements.

FDA does not require explicit ISO 14971 certification, but the standard’s framework directly informs what FDA investigators look for when reviewing design control documentation and risk-related activities during inspections.

One area of particular scrutiny: risk management files must show a clear connection between identified risks, implemented controls, and verification activities. An analysis that documents hazards but does not trace those hazards through to the design history file or validation protocols is incomplete.

ISO 14971 and EU MDR

Under EU MDR (Regulation 2017/745), Annex I General Safety and Performance Requirements explicitly require compliance with ISO 14971 or an equivalent approach. The harmonized standard status of ISO 14971 under EU MDR means that demonstrated compliance with the standard creates a presumption of conformity with the relevant GSPR requirements.

EU notified bodies scrutinize several areas in particular:

• Whether risk acceptability criteria are justified and documented before analysis begins
• Whether all reasonably foreseeable misuse scenarios were analyzed
• Whether the benefit-risk evaluation is supported by clinical evidence
• Whether post-market surveillance data is actually being fed back into the risk management file

The last point is one of the most commonly cited gaps in EU MDR technical file reviews. Risk management is supposed to be a living process, and notified bodies expect to see dated updates to the risk file that reflect post-market experience.

Common gaps in ISO 14971 implementation

Based on inspection observations and notified body feedback, these are the most frequent gaps:

Risk acceptability criteria defined after the analysis. If your risk matrix was built around the analysis results rather than defined independently beforehand, the criteria are not credible. Define criteria first, document the rationale, and apply them consistently.

Incomplete hazard identification. Many risk files focus on hardware failure modes and underrepresent use error scenarios, software-related hazards, and hazards from packaging or sterile barrier failure.

Missing traceability between risk controls and design outputs. Each risk control measure must link to a corresponding design output, and verification that the control was implemented must be documented in the design history file.

No post-production updates. A risk file last updated at design freeze, with no documented review of field complaint data or post-market surveillance findings, will draw scrutiny in any audit.

Overall residual risk conclusion missing or unsupported. The overall residual risk evaluation is required by the standard and is frequently absent or contains only a generic statement without reference to clinical benefit data.

Managing ISO 14971 risk files in an eQMS

ISO 14971 risk management involves multiple interconnected documents: the risk management plan, risk analysis records, risk control documentation, verification evidence, and post-production review records. Managing these across multiple spreadsheets or file folders makes traceability difficult to maintain and demonstrate.

An electronic QMS provides structured risk”>https://www.cloudtheapp.com/glossary-risk-register/”>risk register capabilities that link hazard records to risk controls, connect risk controls to verification activities, and log post-production updates with timestamps and user attribution.

Cloudtheapp’s eQMS includes risk management, FMEA, design controls, and audit management as fully integrated applications. With 60+ applications built for regulated industries including medical device, pharmaceutical, and biotech, Cloudtheapp gives quality teams the traceability and document control they need to maintain a compliant ISO 14971 risk file through every phase of the device lifecycle.

Schedule”>https://www.cloudtheapp.com/demo/”>Schedule a demo to see how Cloudtheapp supports ISO 14971 risk management in practice.

Related reading

• What”>https://www.cloudtheapp.com/what-is-risk-management-in-iso-13485-and-fda-qmsr/”>What Is Risk Management in ISO 13485 and FDA QMSR?
• Medical”>https://www.cloudtheapp.com/medical-device-qms-the-complete-guide-to-fda-qmsr-and-iso-13485-compliance/”>Medical Device QMS: The Complete Guide to FDA QMSR and ISO 13485 Compliance
• What”>https://www.cloudtheapp.com/what-is-fmea-a-practical-guide-for-quality-engineers-and-compliance-teams/”>What Is FMEA? A Practical Guide for Quality Engineers and Compliance Teams

This post created by and appeared first on Cloudtheapp

Nonconforming material is any raw material, component, in-process product, or finished device that fails to meet specified requirements. Under both the FDA's Quality Management System Regulation (QMSR) and ISO 13485:2016, the moment a nonconformance is detected, a documented process must take over — covering how the material is identified, how it is segregated from conforming product, who reviews it, and how it is ultimately dispositioned.

This guide covers what the regulatory requirements actually say, where manufacturers get cited by FDA investigators, and how a properly configured QMS handles nonconforming material without creating documentation gaps.

What constitutes nonconforming material

A nonconforming material event can start at incoming receiving inspection, during in-process manufacturing, or at final product inspection. It can also be identified after product has been released, when a complaint, post-market audit, or field service report reveals that something distributed to customers did not meet specifications.

The scope of what triggers a nonconformance report varies by company procedure, but the regulatory minimum is clear: any product that does not conform to specified requirements must be controlled. This includes deviations from dimensions, materials, documentation requirements, label specifications, sterility requirements, or any other attribute defined in the device master record.

The regulatory framework: 21 CFR 820.90 and ISO 13485 Section 8.3

QMSR and the role of ISO 13485:2016

The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 by reference under 21 CFR 820.10(b). For nonconforming product, this means ISO 13485 Section 8.3 is now legally enforceable FDA requirement in the United States. The old 21 CFR Part 820, Section 820.90, used language that tracked closely with what ISO 13485 Section 8.3 requires, so most manufacturers familiar with the old QSR will find the substantive requirements familiar. The QMSR transition does, however, add some procedural and record-keeping specificity that FDA investigators now check against.

ISO 13485 Section 8.3.1 — documented procedure requirement

Section 8.3.1 requires that the organization establish documented procedures for the control of nonconforming product. This is not a general quality system requirement — it is a specific, auditable procedure that must exist, be implemented, and produce records. FDA investigators ask to see this procedure and then verify that actual nonconformance records reflect the procedure as written.

ISO 13485 Section 8.3.2 — identification and segregation

Section 8.3.2 requires that the organization ensure nonconforming product is identified and controlled to prevent unintended use or delivery. The standard is explicit that the organization must take one of the following actions when nonconforming product is detected: take action to eliminate the detected nonconformity; authorize its use, release, or acceptance under concession; prevent its intended use or application through segregation, return, or destruction; or apply other action appropriate to the effects of the nonconformity when detected after delivery.

The key enforcement point in practice is "prevent unintended use." Physical identification — a quarantine tag, a red hold label, a locked cage — is not optional. FDA warning letters from 2024 and 2025 cite cases where nonconforming product was inadequately segregated and co-mingled with conforming product, or where the physical controls were present but not consistently applied.

ISO 13485 Section 8.3.3 — review authority and documentation

Section 8.3.3 requires that the review of nonconforming product be conducted by personnel with defined authority. The person who makes a disposition decision must have documented authority to do so. It is not enough to have a quality manager sign off generically — the procedure must define who is authorized for what disposition decisions, and the record must show that an authorized person made each specific decision.

Section 8.3.3 also requires that records be maintained describing the nature of the nonconformity, the quantity affected, the disposition decision, and the identity of the person who authorized the disposition.

ISO 13485 Section 8.3.4 — rework

Section 8.3.4 contains specific requirements for product reworked to bring it into conformance. Rework must be performed in accordance with documented instructions. After rework, the product must be re-inspected or re-verified. The potential adverse effects of rework on the product's safety and performance must be documented and reviewed. Rework that affects a device's safety profile without a corresponding safety assessment is a documented finding in multiple FDA warning letters.

Identification: catching nonconformances before product moves

The earlier a nonconformance is detected, the lower the cost and compliance impact. Most manufacturers identify nonconforming material at four points: incoming receiving inspection, in-process inspection during manufacturing, final product inspection before release, and post-release through complaints or field reports.

Incoming receiving inspection is where supplier-related nonconformances surface. Under ISO 13485 Section 7.4.3, receiving inspection records must be maintained, and any nonconformances found at receiving must be documented and dispositioned before the material enters production. Using a supplier's certificate of conformance as a substitute for incoming inspection is acceptable only when the procedure defines specific conditions under which this is permitted — and the procedure must define what happens when a later nonconformance is discovered for material that entered based on a COC.

In-process nonconformances require immediate action to prevent the material from advancing further in the production process. A nonconformance caught at subassembly is cheaper and lower-risk than the same nonconformance discovered at final inspection or after release.

Containment: preventing unintended release

Physical containment is the step most frequently cited in FDA Form 483 observations related to nonconforming material. Containment means the nonconforming material is physically separated from conforming product in a way that prevents accidental release.

Acceptable containment methods include: a dedicated quarantine area with restricted access, locked cages or cabinets for high-risk nonconformances, physical hold tags attached to the material itself, and system-level holds in the QMS that prevent lot release without disposition review. A sticker on a shelf with no physical barrier and no system control does not satisfy containment, nor does a verbal instruction to production staff.

When a nonconformance is detected after product has left the facility, the manufacturer must assess whether the nonconformance poses a risk to patients or users, determine the scope of potentially affected product (lot numbers, date ranges, distribution locations), and decide whether a field action, correction, or removal is warranted. This post-market containment assessment must be documented.

Disposition: the options and what each requires

After containment, the disposition review determines what happens to the nonconforming material. ISO 13485 Section 8.3 recognizes four primary disposition paths.

Rework. The material is brought into conformance through additional processing. Rework requires documented instructions, re-inspection after completion, and a safety assessment if there is any possibility the rework affected the device's safety or performance characteristics.

Concession (accept as-is). The material is accepted for use or release despite the nonconformance, with written authorization. A concession must define the specific nonconformance being accepted, the scope of product involved, the risk basis for accepting it, and the identity of the authorized approver. FDA investigators check that concessions are not being used as a general workaround for recurring process problems.

Return to supplier. For incoming material that does not meet requirements, return to supplier is a documented option. The supplier must be notified, and the return must be documented in the supplier quality management system. Repeated returns from the same supplier without escalation through the supplier qualification process are flagged during audits.

Scrap or destruction. The material is destroyed and removed from the production flow. Destruction must be documented — date, quantity, method, and person responsible. This is particularly important for devices where there is any possibility that scrapped material could be reintroduced into the production stream.

When nonconforming material triggers a CAPA

A single nonconforming material event does not always require a corrective action. The decision to initiate a deviation CAPA should be risk-based: if the nonconformance represents a systemic failure, a recurring pattern, a safety-critical characteristic, or a significant deviation from specification, a CAPA is required.

FDA investigators check the relationship between nonconforming material records and the CAPA system. A manufacturer that has 40 nonconformance records in a year and zero corrective action initiations will have difficulty demonstrating that their corrective action process is functioning as intended. The threshold for CAPA initiation must be defined in the procedure, and the records must show that the threshold is being applied consistently.

When a CAPA is initiated, the nonconformance record should be linked to the corrective action record. This traceability allows investigators to verify that the root cause investigation addressed the actual nonconformance and that the effectiveness check verified the corrective action worked.

What FDA investigators cited in 2024 and 2025

Published FDA warning letters and 483 observation data from 2024 and 2025 show consistent patterns in nonconforming material findings.

Nonconforming product not properly identified. FDA investigators at multiple medical device facilities found nonconforming components that lacked identification tags or hold labels, making it impossible to distinguish them from conforming product in the production area.

Disposition decisions made without documented authority. At several inspected facilities, disposition decisions were made by production supervisors or technicians not identified in the procedure as having disposition authority. The absence of documented authority is a direct Section 8.3.3 violation.

Rework not re-inspected. FDA warning letters from 2024 and 2025 cite rework operations where product was returned to conforming stock without documented re-inspection. In one case involving an orthopedic implant manufacturer, reworked components were released without a safety assessment for the effect of rework on the implant's structural integrity.

Repeat nonconformances without corrective action. FDA investigators consistently flag situations where the same nonconformance appears multiple times within a review period but no corrective action was initiated. The question asked during inspection is typically: "What is your threshold for CAPA initiation, and why was this recurring nonconformance below that threshold?"

Post-market nonconformances not assessed for field action. When complaints or post-market surveillance data revealed nonconformances in distributed product, several manufacturers failed to document a formal assessment of whether a field action was required. FDA expects a documented risk-based evaluation, not an informal determination.

How a QMS system handles nonconforming material at scale

At low volumes, a paper-based or spreadsheet-driven nonconforming material process can be managed, though it is difficult to maintain traceability and even harder to demonstrate consistency during an inspection. As production volume increases, the gaps in manual systems compound.

A well-configured eQMS handles nonconforming material by creating a digital record at the point of detection, automatically flagging the affected lot or batch in the inventory system to prevent release, routing the disposition review to the personnel with defined authority, and generating the required re-inspection task when a rework disposition is selected. The system also provides the trend analysis needed to identify recurring nonconformances that should trigger a CAPA.

Cloudtheapp includes a Nonconforming Material application that manages the full nonconformance workflow — identification, containment, disposition review, rework tracking, and CAPA linkage — within a single validated platform. Lot-level traceability means that when a post-market nonconformance is identified, the system can quickly identify all affected product and its distribution status.

The platform is validated for 21 CFR Part 820 (QMSR) and ISO 13485, with a full validation package provided for every update. If your nonconforming material process relies on spreadsheets, paper logs, or disconnected systems, schedule a demo at Cloudtheapp to see how the platform handles NCM from detection through closed-loop corrective action.

This post created by and appeared first on Cloudtheapp

For any company that designs, manufactures, or distributes medical devices in the United States or globally, a robust Quality Management System (QMS) is not a best practice but a legal and regulatory requirement. Whether you are building your first quality system or modernizing a legacy platform, understanding what a medical device QMS must do, what regulations govern it, and how software can support compliance is essential knowledge for every Quality professional in the industry.

What Is a Medical Device QMS?

A medical device QMS is a structured set of documented policies, processes, procedures, and records that governs how a company designs, manufactures, controls, and continuously improves its medical devices. Its purpose is to ensure that every device reaching a patient or healthcare provider consistently meets defined safety, performance, and regulatory requirements.

Unlike QMS frameworks used in general manufacturing, a medical device QMS must address a set of unique requirements: design validation, post-market surveillance, complaint handling with MDR reportability assessment, and full traceability from raw material to finished device. These demands are codified in FDA regulations and international standards that together form the backbone of global medical device quality compliance.

The scope of the QMS extends across the entire product lifecycle, from initial concept and design through manufacturing, distribution, and post-market monitoring. Every function involved in product quality, including R&D, manufacturing, procurement, customer support, and management, operates within its boundaries.

The FDA QMSR: What Changed on February 2, 2026

On February 2, 2026, the FDA's Quality Management System Regulation (QMSR) officially took effect, replacing the legacy Quality System Regulation (QSR) found in 21 CFR Part 820. This was the most significant regulatory update to medical device quality requirements in the United States in nearly three decades.

The QMSR formally incorporated ISO 13485:2016 into U.S. law, effectively harmonizing FDA requirements with the international standard used in Canada, the European Union, and most major global markets. For device manufacturers, this change carries several practical implications.

First, the QMSR adopts much of the ISO 13485:2016 language and structure directly. Terms, definitions, and process requirements are now largely shared between the two frameworks, which reduces the burden of maintaining separate documentation systems for different regulatory markets.

Second, the QMSR strengthens risk management requirements. Risk-based thinking, which was already central to ISO 13485 and ISO 14971, is now woven more explicitly into every major QMS process under U.S. regulation. Manufacturers must demonstrate that risk management is integrated into design, production, supplier management, and post-market activities, not treated as a standalone exercise.

Third, the QMSR expands requirements around software. Given how heavily modern device development relies on software, including Software as a Medical Device (SaMD) and software used in production, the QMSR places greater emphasis on software validation and 21 CFR Part 11 compliance for electronic records and signatures used in the quality system.

For companies already certified to ISO 13485:2016, the transition to QMSR is relatively straightforward. For companies that had been operating under the legacy QSR alone, a formal gap analysis and system update are required before the compliance deadline.

Core Processes a Medical Device QMS Must Cover

A compliant medical device QMS under QMSR and ISO 13485:2016 must address eight core process areas. Each carries specific documentation and record-keeping requirements that FDA investigators and notified bodies will examine during inspections.

Design Controls govern the structured process by which a device concept is translated into a finished, validated product. Design controls require documentation of user needs, design inputs, design outputs, design verification, design validation, and design transfer. Every change to a design must be reviewed, approved, and traced back to the original inputs.

CAPA (Corrective and Preventive Action) is the system by which nonconformances, complaints, audit findings, and deviations are investigated, root causes identified, and permanent corrective actions implemented and verified for effectiveness. Under QMSR, CAPA is one of the most scrutinized processes during FDA inspections.

Document Control ensures that approved, current versions of procedures, work instructions, specifications, and forms are available at point of use, and that obsolete documents are promptly removed from circulation. The audit trail for document changes must be complete, tamper-evident, and fully retrievable.

Nonconformance Management captures and evaluates product or process nonconformities, routes them through formal disposition (accept, reject, rework, or scrap), and initiates CAPA where appropriate. A deviation report is typically generated for each nonconformity that requires formal investigation and disposition documentation.

Complaint Handling requires that all complaints about a device's performance, safety, or labeling are received, logged, investigated, and assessed for their Medical Device Report (MDR) reportability. All complaint records must be retained and made available upon inspection.

Audits are a required element under both QMSR and ISO 13485:2016. Internal process audits evaluate whether procedures are being followed and whether the QMS is achieving its intended outcomes. A structured audit program, with documented findings, assigned corrective actions, and verified follow-up closure, is essential evidence of a functioning quality system.

Supplier Quality Management (SQM) governs how a company evaluates, approves, monitors, and re-qualifies its suppliers and contract manufacturers. QMSR and ISO 13485:2016 both require documented supplier qualification criteria, supplier audits, and defined acceptance thresholds for ongoing supplier performance.

Post-Market Surveillance ensures that data on device performance in the field is systematically collected, analyzed, and fed back into the quality system. This includes adverse event reporting, field complaint trend analysis, and feedback loops into design controls and CAPA processes.

The Design History File: The Most Audited Artifact in Medical Device Quality

The Design History File (DHF) is the compiled record of all design activities performed during the development of a medical device. It demonstrates that the device was designed and developed in accordance with the approved design plan and all applicable regulatory and technical requirements.

A complete DHF typically includes the design and development plan, design inputs and outputs, verification and validation protocols and reports, design review meeting records, design transfer documentation, and a full history of all design changes with rationale. Under QMSR, maintaining a complete, well-organized DHF is one of the first things FDA investigators request during a facility inspection.

Many companies struggle with DHF integrity because it is built over the entire product development lifecycle and spans multiple teams, document types, and systems. When those systems are disconnected spreadsheets, shared drives, or email threads, the DHF becomes fragmented and difficult to defend under scrutiny. A purpose-built quality management platform that links design control records directly to the DHF resolves this problem by creating a single, traceable source of truth from initial design input to commercial release.

CAPA for Medical Devices: Effectiveness Verification Under QMSR

Corrective and Preventive Action under QMSR is more demanding than CAPA in general industry QMS frameworks. The regulation requires not just that a corrective action be implemented, but that its effectiveness be verified: the root cause must be confirmed, the corrective action must demonstrably eliminate the root cause, and the verification must be documented with objective evidence before the CAPA record is formally closed.

A root cause investigation is the foundation of every effective CAPA. The investigation must be structured, traceable, and documented in enough detail that an auditor who was not present can follow the full logic from initial symptom to identified root cause to selected corrective action. Common investigation methods include fishbone (Ishikawa) analysis, 5-Why analysis, and fault tree analysis.

Effectiveness verification typically involves defining measurable success criteria before the corrective action is implemented, collecting objective data after implementation, and formally closing the CAPA record only when the data confirms the corrective action achieved its intended outcome. If the verification fails, the CAPA must be reopened and the investigation extended.

A pattern of CAPAs closed without documented effectiveness verification is one of the most frequently cited findings in FDA Form 483 inspection observations. A well-configured QMS platform enforces effectiveness verification as a required workflow step, preventing the system from allowing premature or unsupported CAPA closure.

What to Look For in Medical Device QMS Software

Selecting the right QMS platform is one of the most consequential technology decisions a medical device company can make. The software must support regulatory compliance without creating bureaucratic friction that slows quality teams down. Here are the most important criteria to evaluate during a software selection process.

Validation status. The platform itself must be validated in accordance with FDA Computer System Validation guidelines and 21 CFR Part 11 requirements. The vendor should provide a comprehensive validation package for each software update, including IQ, OQ, and PQ documentation. Companies that must validate software independently face significant ongoing cost and resource burden.

End-to-end QMSR coverage. The platform should natively support all eight core QMS processes described above, including design controls with DHF management, CAPA with effectiveness verification workflows, document control with version-controlled approval, and audit management with full finding-to-closure traceability. Point solutions or bolt-on modules that do not share a common data model create traceability gaps that become liabilities during an inspection.

Risk register and risk management integration. Risk-based thinking under QMSR means risk data must be connected to CAPA, design controls, supplier management, and post-market surveillance. A platform that treats risk management as a disconnected module will struggle to demonstrate the integrated risk management approach regulators expect to see.

Audit trail and electronic signature compliance. Every significant record action, including creation, review, approval, and change, must be captured in a tamper-evident audit trail with electronic signatures that comply with 21 CFR Part 11. This is a non-negotiable requirement for any FDA-regulated manufacturer operating a digital quality system.

Configurability without coding. Device manufacturers operate across a wide range of product types, market geographies, and organizational structures. A platform that requires IT resources or vendor professional services to modify core workflows creates dependency and slows adaptation to regulatory changes. No-code configurability allows Quality teams to own and update their processes directly, at the speed the business requires.

Supplier quality capabilities. Supplier qualification, Supplier Corrective Action Request (SCAR) management, and supplier performance monitoring should be built into the platform rather than managed in separate spreadsheets. The system should allow external supplier contacts to access and respond to assigned records without requiring a full internal platform license.

Scalability and post-market surveillance support. As a device company grows from startup to commercial stage, the QMS platform must scale without requiring re-implementation. Post-market data collection, complaint trending, and feedback integration into the quality system should be native platform capabilities, not manual workarounds.

Build a Fully Compliant Medical Device QMS with Cloudtheapp

Cloudtheapp is an AI-powered, fully validated, cloud-native QMS platform built specifically for medical device manufacturers and other regulated industries. The platform is pre-validated to FDA Computer System Validation guidelines and supports 21 CFR Part 820 (QMSR), ISO 13485:2016, 21 CFR Part 11, and ISO 9001 out of the box.

With more than 45 configurable applications covering every element of a compliant medical device QMS, from Design Controls and CAPA to Audits, Complaint Handling, Document Control, Supplier Quality Management, and Post-Market Surveillance, Cloudtheapp delivers an end-to-end quality system in a single, connected platform. All applications share a common data model, ensuring full traceability from design input to complaint to CAPA to verified effectiveness.

The platform's AI-driven, no-code configurability means your Quality team can adapt workflows to QMSR requirements, deploy new application configurations in minutes, and maintain full validated status without IT involvement or custom development costs. Cloudtheapp also delivers a complete validation package for every platform update, automatically, so your system stays in compliance as regulations continue to evolve.

If your medical device quality system is still running on spreadsheets, legacy point solutions, or a platform that predates the QMSR, now is the time to evaluate a modern, validated, fully integrated alternative.

Request a Demo or start a 30-Day Free Trial to see how Cloudtheapp can help your team build and maintain a fully compliant medical device QMS from day one.

This post created by and appeared first on Cloudtheapp