Define
Set the scope, process owners, responsibilities, interfaces, criteria and required records.
MDR · IVDR · ISO 13485 · FDA QMSR
Quality management system services for medical device companies
Build a QMS that controls the work, supports the product and produces reviewable evidence.
EUMDR and IVDR
StandardISO 13485
United StatesFDA QMSR
Controlled QMS
Responsibilities · processes · records
01
Regulatory strategy
Markets, routes and obligations
02
Product realization
Design, supply and production
03
Lifecycle evidence
Risk, clinical, performance and PMS
04
Improvement
CAPA, audit and management reviewThe operating principle
A QMS is not a folder of procedures
It is the controlled way an organisation converts requirements into decisions, work and evidence. The documents define the system. Daily practice and records demonstrate that it operates.
Operate
Use the controlled processes in design, supply, production, release and lifecycle activities.
Prove
Retain objective evidence that trained people followed the process and reached traceable decisions.
Improve
Use data, audits, CAPA and management review to correct weaknesses and improve effectiveness.
Service scope
Build the system around the work that must be controlled
We can design a new QMS, remediate an existing system or prepare a defined process set for certification, notified-body assessment or FDA inspection readiness.
Define the project scopeQMS architecture and scope
Legal-manufacturer activities, sites, device portfolios, target markets, outsourced processes, exclusions and process interactions.
Governance and controlled information
Quality policy, objectives, responsibilities, document control, record control, change control, training and competence.
Design and product realization
Planning, inputs, outputs, reviews, verification, validation, transfer, release and control of design or process changes.
Supplier and production controls
Risk-based supplier qualification, purchasing controls, outsourced-process oversight, production controls and acceptance records.
Regulatory and lifecycle interfaces
Risk management, clinical or performance evaluation, technical documentation, registration, UDI, PMS, vigilance and field action.
Measurement and improvement
Complaints, nonconformity, data analysis, CAPA, internal audit, management review and effectiveness checks.
MDR and IVDR system coverage
Connect the legal obligations to the operating QMS
Article 10 of the MDR and IVDR requires a documented and maintained QMS that is proportionate to the device risk class and type. The system must cover the applicable regulatory and lifecycle processes.
Regulatory compliance strategy
Conformity-assessment routes, significant changes, market access and controlled compliance planning
Applicable requirements
Identification of legal requirements and methods for addressing the GSPR
Management and resources
Responsibilities, competence, infrastructure, objectives and management oversight
Suppliers and subcontractors
Selection, controls, monitoring and evidence for outsourced activities
Risk and evidence
Risk management, clinical or performance evaluation and post-market follow-up
Product realization
Planning, design, development, production, service and controlled changes
Market obligations
UDI, registration, EUDAMED, PMS, vigilance and field safety corrective action
Corrective action
Nonconformity, CAPA, effectiveness checks and continual improvement
Process architecture
Make responsibility and evidence flow visible
Direction
Management processes
Strategy · policy · objectives · resources · management review
Value
Core lifecycle processes
Regulatory planning · design and development · supply · production · release · market support
Control
Supporting processes
Documents · records · competence · infrastructure · suppliers · software · data integrity
Feedback
Measurement and improvement
Complaints · PMS · audit · nonconformity · CAPA · data analysis · effectiveness
A procedure belongs in the architecture only when its inputs, outputs, owner, controls, records and interfaces are understood.
Framework comparison
Use one system with explicit regulatory mappings
ISO 13485, the EU Regulations and the FDA QMSR are related, but they are not interchangeable labels. The QMS must show which requirement each process addresses and which jurisdiction-specific controls remain.
ISO 13485
A certifiable medical-device QMS framework for consistent product and regulatory-process control.
- Process-based quality system
- Medical-device lifecycle controls
- Certification by an accredited certification body where sought
MDR and IVDR
Binding manufacturer obligations that connect the QMS to the device, technical documentation and conformity assessment.
- Article 10 QMS obligations
- Device-specific regulatory and evidence processes
- Notified-body assessment where required by the selected route
FDA QMSR
Effective since 2 February 2026, the QMSR incorporates ISO 13485:2016 by reference and retains FDA-specific provisions.
- 21 CFR Part 820 requirements
- FDA definitions and supplemental controls
- Interfaces with other applicable FDA regulations
An ISO 13485 certificate can support confidence in the QMS. It does not, by itself, establish compliance with every applicable MDR, IVDR or FDA requirement.
Working method
Move from intended scope to operating evidence
- 01
Define the scope
Confirm the legal manufacturer, sites, products, lifecycle stages, target markets and assessment objectives.
- 02
Assess the current system
Map existing processes, documents, records, responsibilities, software, outsourced activities and gaps.
- 03
Design the architecture
Set process ownership, interactions, controls, criteria, templates and the hierarchy of controlled information.
- 04
Create controlled documents
Draft proportionate procedures and forms that reflect the organisation’s actual operating model.
- 05
Implement and train
Release documents, assign responsibilities, train users and begin generating objective evidence.
- 06
Test effectiveness
Review records, perform an internal audit, address findings and confirm process effectiveness.
- 07
Complete management review
Present system data, decisions, resource needs and improvement actions to top management.
- 08
Prepare for assessment
Reconcile evidence, test traceability and support certification, notified-body or inspection readiness.
Engagement models
Match the support to the maturity of the system
We can work alongside your quality and regulatory team or take responsibility for a defined QMS work package with agreed inputs, deliverables and decision points.
New QMS build
Create a proportionate system for a new manufacturer, product programme or market-entry strategy.
Targeted remediation
Resolve audit findings, disconnected processes, excessive documentation or evidence gaps.
Readiness programme
Prepare for ISO 13485 certification, notified-body assessment or FDA inspection through staged implementation and testing.
Ongoing quality support
Maintain selected processes, conduct internal audits, support CAPA and keep the QMS aligned with organisational change.
Common failure patterns
Correct the system, not only the document
Findings recur when a procedure is revised but ownership, data, competence or the connected process remains unchanged.
Templates describe an organisation that does not exist
Procedures and daily practice use different workflows
Process owners cannot explain their inputs, outputs or records
Risk, clinical, performance and PMS conclusions are disconnected
Supplier controls do not reflect product or process risk
Implementation is claimed without objective evidence or effectiveness checks
Connected services
Keep the QMS aligned with the product evidence
01
02
03
Technical documentation
Connect QMS controls to the released device and its Annex II and Annex III records.
Risk management and PMS
Build the lifecycle feedback system that informs action and file updates.
Clinical evaluation
Control the clinical evidence process and its interfaces with risk and PMS.
Regulatory basis
Use the current legal and standards framework
The final QMS scope remains organisation and device specific. These official sources establish the principal frameworks used to define it.
01
02
03
04
Regulation (EU) 2017/745
Article 10 manufacturer obligations and Annex IX QMS assessment
Regulation (EU) 2017/746
Article 10 manufacturer obligations and Annex IX QMS assessment
ISO 13485:2016
Official ISO overview of the medical-device quality-management standard
FDA Quality Management System Regulation
Current FDA information on QMSR and incorporation of ISO 13485:2016
Questions in practice
Quality management systems
Is ISO 13485 certification mandatory under the MDR or IVDR?
The MDR and IVDR require manufacturers to establish, document, implement, maintain and continually improve a QMS. They do not make possession of an ISO 13485 certificate a universal condition for every manufacturer. The applicable conformity-assessment route, device class and notified-body involvement must be assessed for the specific device.
Does ISO 13485 certification prove MDR or IVDR compliance?
No. ISO 13485 provides a medical-device QMS framework, but MDR and IVDR compliance also depends on applicable legal obligations, device-specific technical documentation, clinical or performance evidence, post-market activities and the relevant conformity-assessment procedure.
Can one QMS cover both medical devices and IVDs?
Yes. One controlled QMS can cover MDR and IVDR activities when its scope, responsibilities, procedures and records distinguish the applicable device types, classifications, evidence processes and regulatory requirements.
What is the difference between a QMS and a quality manual?
The QMS is the operating system of responsibilities, processes, controls and records. A quality manual is one controlled document that describes the system and its scope. A manual alone does not demonstrate implementation.
How does the FDA QMSR relate to ISO 13485?
The FDA Quality Management System Regulation became effective on 2 February 2026 and incorporates ISO 13485:2016 by reference. Manufacturers must also address the applicable FDA-specific requirements in 21 CFR Part 820 and other relevant FDA regulations.
How long does QMS implementation take?
The schedule depends on the company scope, device lifecycle, existing controls, team availability and target assessment date. A realistic plan includes not only document creation but also training, operation, records, internal audit, corrective action and management review.
Start with the operating model
Build a QMS your team can use and an assessor can follow
Tell us the organisation, device portfolio, target markets, current QMS status and next assessment milestone. We will propose a focused scope.