NEW YORK – A quality system that has been in place for almost 30 years is about to be replaced by the US Food and Drug Administration, with potentially widespread implications for the in vitro diagnostics industry, as well as clinical laboratories, according to experts.
Since 1997, the Quality System Regulation, or 21 CFR 820, has governed medical device developers and manufacturers seeking FDA approval. But starting in early 2026, that existing regulation will be replaced with updated rules, called the Quality Management System Regulation, or QMSR. This update aims to align the FDA's quality requirements more closely with the international standard for medical devices: the International Organization for Standardization's standard, ISO 13485:2016.
While the upcoming regulation, which was released by the FDA earlier this year, is largely the same as the ISO standard, there are key differences between the two sets of rules, which some industry observers are warning could place an overwhelming burden on laboratories that are not prepared to create and maintain manufacturer-level quality systems. And many labs may not be since clinical laboratories aren't currently subject to the FDA's quality regulations but will be if the FDA's quest to regulate laboratory-developed tests is finalized, which is expected to occur sometime this month.
Meantime, the QMSR is scheduled to go into effect on Feb. 2, 2026.
According to Eric Henry, a senior quality systems and compliance adviser at law firm King and Spalding, the FDA's new quality system rules go back to 2018 when the agency decided that it wanted to realign its quality regulations with the ISO 13485 standard after it was revised in 2016. The new QMSR, he said, utilizes a mechanism called "incorporation by reference," meaning it refers to the ISO standard to which IVD manufacturers that develop and manufacture FDA-cleared products will have to adhere, with only a few explicitly documented regulatory requirements that must be clarified or that supersede the ISO standard.
Most of the changes are "definitional" and will make certain terms align more with the ISO standard, Henry said, though the implications of those changes may vary widely.
But some key updates involve changes in how risk management is addressed or how documentation of quality systems is handled.
For example, in the existing QSR, risk management is mentioned only one time, in relation to design validation and design controls. However, the ISO 13485 standard has a much larger focus on risk management, and it is mentioned throughout the development cycle.
As a result, with the QMSR, "I think every medical device manufacturer's going to have to look at risk management a little differently," Henry said. Because the ISO standard "address[es] risk much more extensively than the existing Quality System Regulation; it pushes the industry more towards mature risk management practices."
"I see a lot more addressing of risk management here than what we've had previously," he added.
How the FDA will conduct inspections will also change, Henry noted. The FDA has thus far stayed away from auditing internal management review minutes, internal audit reports, and supplier audit reports. Under the new QMSR rules, those documents will be subject to inspection, which may be difficult for firms that have that data but are not used to providing it in FDA inspections.
Although the FDA audits and ISO certification audits will likely be "almost identical" once QMSR goes into effect, the regulations are "just different enough … that it may actually get a little frustrating" for manufacturers, Henry said. For example, the QMSR requires firms to inspect a statistical sampling of labels for accuracy while the ISO standard does not, and the FDA will check that this requirement is met. Also, the FDA can stay as long as it wants at US sites, where a notified body conducting an ISO audit typically limits its audits to one week or less.
In addition, despite the aligned regulations, one inspection can't substitute for another: The FDA cannot grant ISO 13485 certification, and companies that have ISO 13485 certification won't be exempt from FDA inspection.
Some of the differences in the QMSR regulation and ISO 13485 are related to legislation, Henry said. The Food, Drugs, and Cosmetic Act, which provides the FDA with regulatory power over medical device manufacturers, among other things, conflicts with certain parts of the ISO standard — namely, the requirements for packaging and labeling of medical devices are more stringent in the US than under the ISO standard.
For companies that are already ISO 13485 certified, the burden imposed by the QMSR will be "minor to moderate," Henry said. "Except for some of the definitions and some of the nuanced tasks where ISO 13485 differs from the Quality System Regulation, I don't think the difference is going to be that great," he noted, although the changes "might push the industry to more mature practices."
Most firms that operate internationally already must conform to ISO 13485 standards, and for those companies, the new QMSR will reduce the burden of having to satisfy the existing FDA and ISO rules, he said.
Dennis Shay, head of regulatory affairs at point-of-care diagnostic company 3EO Health, said that his firm will not be significantly affected because it has already aligned its quality system with both 21 CFR 820 and ISO 13485. It is "less and less common that a company is exclusively US-based and will only ever be US-based," he noted, but those "bare-bones companies" with only one device that are focusing on the US market only may be heavily affected.
Ajay Shah, CEO and cofounder of sepsis diagnostic company Cytovale, echoed Shay's comments, saying that his firm has set up its quality management system to comply with both ISO 13485 and QMSR requirements and that it plans to seek ISO certification in 2025. The company's internal audit program reviews the quality management system each quarter to ensure it maintains compliance with both standards, and Shah said that the time, personnel, and financial impacts are expected to be low. In the long run, he added, "regulatory activities may be streamlined as the requirements to meet ISO 13485 and the new QMSR become aligned." However, "other organizations may not have constructed their systems with both systems in mind and may have a much greater burden to transition."
For such firms, Henry said, at a bare minimum employees will have to be trained on the new regulations. Meanwhile, with the exception of a view-only version of ISO 13485 available on an American National Standards Institute website, access to the ISO standards is limited because the actual standards are copyrighted and anyone who wants to fully access them and print them out has to pay to do so. A copy of the standard costs CHF 173.00 ($189.61) on the ISO website.
The new QMSR rules may also nudge some firms to broaden their commercial scope, said Fayyaz Memon, founder and managing director of consulting firm AltaQ. There will likely be companies that figure if they are already making changes to align with QMSR, they might as well get ISO certification, seek In Vitro Diagnostic Regulation authorization from the EU, and expand their commercialization to Europe. "Before … they were hesitant if they could comply with these things. Now I think they can probably go market" their products, he said.
Beyond the companies that have to adhere to the new regulations, there will also be a burden on FDA inspectors who must enforce the new requirements, Henry said. Even if the number of inspections doesn't change, the agency will need to ensure their inspectors are properly trained to conduct inspections according to the QMSR once it becomes effective.
A spokesperson for the FDA said via email that the agency "intends to engage in a variety of implementation activities, including updating information technology systems, training FDA staff responsible for assessing compliance with medical device quality management system requirements, finalizing the inspection process, revising relevant regulations and other documents impacted by this rulemaking, and communicating and educating stakeholders on the change."
The agency does not plan to utilize third parties to conduct the inspections but will instead develop a new inspection process that aligns with the QMSR requirements, the spokesperson noted, adding staff will be trained on the final rule, the inspection process, and changes to associated policies and procedures.
Henry, however, said that he is unsure if the FDA will meet the deadline to have new guidelines on its inspections in place and have all staff trained on them. "It's not the workforce capacity I'm worried about, so much as its capability," he noted.
Further, as the FDA charges ahead on its mission to regulate LDTs, an endeavor that could tax its resources, how much manpower will be left to facilitate the change to the QMSR is especially up for question.
Joshua Levin, an IVD industry consultant and professional, said that he is concerned about the lack of available support for companies that need to transition their quality systems. Although there are consultants who can help support the transition, there "aren't enough consultants with this type of expertise," and a lot of firms will struggle with the change, he said.
One other key question involves how the QMSR may be affected if ISO 13485 changes. Because so much of the FDA's regulation is tied to ISO 13485, if that standard changes, it is unclear what will happen to QMSR and how it will be changed — particularly the sections that reference ISO 13485 directly. The ISO standard is next up for discussion of changes in 2026.
Clinical lab effects
The QMSR will be applied to medical device manufacturers in less than two years, and if the FDA is successful in its mission to regulate LDTs, clinical labs will also have to comply with the new quality system. According to some observers, the burden under the QMSR could be significant for laboratories currently running LDTs, and the entire assay development process may need to be reevaluated and redesigned.
Levin said the additional financial and time burden of having to adhere to QMSR could lead to tests currently offered as LDTs being discontinued and coming off the market because the return on investment will be too small to maintain them. In addition, many manufacturers rely on clinical laboratories to conduct verification and validation work for their tests, which could also be impacted by the new quality requirements.
There is "not as big of a difference between ISO 13485 and QSR … but the gap is very significant between LDTs and … QSR," AltaQ's Memon said. Laboratories that are used to developing tests in two months will now have to go through the entire design control process, which can take much longer, he added.
"They'll have to follow the process from design input to design output, and they don't have that part," he said.
Clinical laboratories used to running LDTs also often don't have processes for documenting design and change controls for each test or reporting requirements and other key components required by QMSR. Putting a quality system in place is also "a huge cultural change," said Sheila Walcoff, CEO and founder of Goldbug Strategies. "You have to hire a quality manager if you don't have one. The responsibility moves from the lab director to the CEO, and just writing all of these documents takes a lot of time."
The changes in quality system management are yet another reason many clinical labs do not want the FDA regulating LDTs. A spokesperson from the American Clinical Laboratory Association said that "subjecting laboratories to device law is misguided, both as a matter of law and public policy."
"This includes the requirements of the QMSR. Under the QMSR rule, device manufacturers would be required to transition from existing QSR requirements to ISO 13485 (and certain additional requirements). ISO 13485 is an international standard focused on traditional device manufacturing activities. It is ill-suited for laboratories," the ACLA spokesperson added.
Currently, clinical labs generally follow CLIA regulations and seek accreditation from the College of American Pathologists, but those approaches are "very different" from the FDA's regulations because they rely heavily on self-reporting by laboratory directors, Memon said. "The lab director is responsible for everything, so whatever he or she says goes," he added. It also "relies on training and proficiency; it relies more on the personnel aspect of things."
The FDA "relies on the process side and having the right process in place to produce the right product," Memon said. The FDA is more intent on making sure processes for design control, complaint management, and other components of companies' quality control are correct and consistent. "If you take the people out, the product will still be the right product," under the FDA's method, he said. Whereas under CAP and CLIA regulations, "if people change, it can have an impact on the product."
The FDA's auditing is also enforcement-based — there is no submission or request for certification, just notification that an inspection will occur.
Levin said that the big change between QMSR and CLIA for clinical laboratories will be in product design controls. Under the new regulations, formal design work will be required, meaning labs will have to determine the risks, hazards, and specifications of their products and make sure that work is traceable through documentation, he said. It will be a "change in how tests are designed," he added.
This change will cost more money and take more time than current test development, Levin noted. Labs currently don't have to adhere to these requirements, but traditional diagnostic companies seeking FDA approval do, so they won't be as affected by this change.
However, Walcoff noted that CLIA "isn't going anywhere," so if the FDA's LDT regulation goes through, clinical labs will have to comply with both CLIA and QMSR. Because there's not a lot of overlap between the two regulations, labs will have an extra burden to adhere to both. CLIA is "a totally different language" than QMSR, she noted, because CLIA is focused on lab operations rather than individual test systems.
Walcoff added that the extra cost and time to developing tests that are compliant with QMSR and FDA validation requirements is a "serious, serious risk," depending on a lab's funding and the current capital market. "Some labs are going to go out of business under the new FDA rules because they're just not going to have the investors willing to put up the extra millions that they need to do it, which is not a good outcome for patients."
She noted that labs can operate as CLIA-only laboratories, but they will have to run only test panels from manufacturers available as FDA-approved kits with no modifications. "If you're not developing LDTs or running combinations of components labeled RUO [for research use only], then you're not considered a medical device manufacturer under the proposed rule," she said.
When it comes to QMSR, many LDT developers "will be starting from ground zero," Memon added.