Medical Device Manufacturers in the US: FDA Regulations, QMSR Requirements and Compliance

For medical device manufacturers, US market access requires more than an FDA submission. A compliant strategy connects device classification, the appropriate premarket pathway, establishment registration, a functioning quality management system and ongoing postmarket obligations. FDA regulations for medical devices apply across this lifecycle, including to foreign manufacturers supplying the US market.

The Quality Management System Regulation (QMSR) became effective on February 2, 2026. Manufacturers must now comply with the revised 21 CFR Part 820 where applicable. Crucially, QMSR compliance does not itself provide FDA clearance or approval, and marketing authorization does not remove quality-system obligations.

Start with device classification and the premarket pathway

FDA classification depends on a device’s intended use, indications for use and the controls needed to provide reasonable assurance of safety and effectiveness. Start with the applicable classification regulation and product code, not simply how similar products are advertised.

The FDA’s device classification guidance explains how to identify a device’s regulatory category.

A 510(k) demonstrates substantial equivalence to a legally marketed predicate device. It results in clearance, not approval.

A De Novo request can establish a Class I or Class II classification for a novel device without a legally marketed predicate when general controls, or general and special controls, can adequately address its risks.

A premarket approval application (PMA) evaluates whether there is reasonable assurance of safety and effectiveness for the device.

For medical device manufacturers, the practical sequence is to confirm classification first, then define the evidence plan. Software, sterility, biocompatibility, electrical safety and clinical performance requirements depend on the particular device. Where classification remains uncertain, an FDA interaction may help resolve the regulatory strategy before extensive testing begins.

Establishment registration and device listing are separate obligations

Establishment registration identifies regulated facilities and their activities. Device listing identifies the devices associated with those activities. Neither process establishes that a device is cleared, approved or compliant with every applicable requirement.

FDA generally requires annual establishment registration renewal between October 1 and December 31. Applicable establishments must also pay the annual registration fee. Foreign manufacturers must address US-agent requirements as part of their registration arrangements.

Responsibilities depend on the establishment’s actual role. A specification developer, contract manufacturer, sterilization facility and initial importer may have different obligations. Outsourcing production does not automatically remove the legal manufacturer’s responsibilities.

Medical device manufacturers should keep registration, listing and marketing-authorization information aligned with their actual operations. Changes to facilities, activities or devices can require updates outside the annual renewal exercise.

Use the FDA’s registration and listing resources to confirm the requirements for each establishment type. OMC Medical’s guide to registering a medical device in the USA provides additional context for organizing the market-entry process.

What medical device manufacturers must do under QMSR

The FDA QMSR regulation amended 21 CFR Part 820 by incorporating ISO 13485:2016 by reference, together with FDA-specific provisions. The effective date has passed, so QMSR should be treated as the current operating requirement, not a future transition project.

The FDA’s QMSR information explains the relationship between the revised regulation and the international quality-management standard.

Three distinctions matter:

• Part 820 remains in force: QMSR revised the regulation rather than replacing US regulatory obligations with a standalone ISO certificate.

• ISO certification is not FDA authorization: FDA does not require an ISO 13485 certificate as a substitute for demonstrating QMSR compliance.

• Other FDA requirements still apply: Registration, labeling, reporting and applicable premarket requirements remain separate obligations.

Medical device manufacturers with an existing ISO 13485 system should assess FDA-specific gaps rather than assume certification completes the work. Conversely, a legacy Quality System Regulation procedure set needs more than updated terminology to demonstrate compliance with the revised framework.

Translate requirements into operating evidence

An effective quality management system connects management responsibility, resources, product realization, risk management, monitoring and improvement. Its scope should reflect the products manufactured and the activities performed or outsourced.

Typical evidence includes approved procedures, training records, supplier evaluations, design and development records where applicable, production controls, validation records, complaint investigations and corrective actions.

Design and development requirements generally apply to Class II and Class III devices and specified Class I devices. Some devices have exemptions from quality-system requirements, but the applicable classification regulation and any retained obligations must be checked individually.

Medical device manufacturers need evidence that these processes work together. For example, a complaint involving package integrity may require a risk review, investigation of the sealing process, supplier input and assessment of whether a regulatory report is required.

FDA-specific provisions include additional requirements for records under 21 CFR 820.35 and device labeling and packaging controls under 21 CFR 820.45. Inspection preparation should also account for FDA access to management review, quality audit and supplier audit records under QMSR.

Qualify suppliers without confusing sourcing with compliance

Supplier qualification should reflect the risk of the purchased product or service. Define specifications, acceptance criteria, change-notification expectations and any validation responsibilities before relying on a supplier’s output.

For textile-device supply chains, such as medical gowns, domestic apparel sourcing considerations can help procurement teams frame commercial questions about sampling, capacity and minimum order quantities. Those checks do not establish medical-device compliance or replace device-specific supplier qualification.

Medical device manufacturers remain responsible for controlling outsourced processes that affect product conformity. A domestic address, ISO certificate or successful sample run is not sufficient evidence by itself.

A useful supplier file explains why the supplier was approved, which requirements it must meet, how performance is monitored and what happens when a material, process or manufacturing location changes. Origin-labeling claims such as “Made in USA” also require separate assessment and should not be presented as evidence of FDA authorization.

Labeling and UDI requirements need their own review

Device labeling requirements generally sit under 21 CFR Part 801, with additional requirements for in vitro diagnostic products under 21 CFR Part 809. Labeling review should cover intended use, indications, warnings, instructions and consistency with the device’s regulatory status.

Do not describe establishment registration or an FDA listing as product approval. Promotional claims can also create compliance problems if they introduce uses beyond the authorized scope.

The FDA’s Unique Device Identification system establishes device-identification requirements, subject to applicable exceptions and alternatives. Relevant obligations appear in Parts 801 and 830.

A UDI includes a device identifier and production identifiers when applicable. The Global Unique Device Identification Database (GUDID) holds device identifier information, not the production data for every individual unit.

For medical device manufacturers managing multiple configurations or packaging levels, UDI planning should be integrated with labeling control and change assessment. Determine whether a change requires a new device identifier, a GUDID update or other regulatory action instead of treating UDI as a one-time artwork task.

Postmarket compliance includes complaints, MDR and corrective action

A complaint procedure is only one part of postmarket compliance. Manufacturers must assess incoming information for safety signals, reportability, investigation needs and corrective action.

Under 21 CFR Part 803, manufacturers generally must submit Medical Device Reports within 30 calendar days after becoming aware of information that reasonably suggests a device may have caused or contributed to a death or serious injury. Certain malfunctions are also reportable when recurrence would likely cause or contribute to death or serious injury.

A five-workday report applies in specified circumstances, including certain remedial actions needed to prevent an unreasonable risk of substantial harm to public health or a written FDA request.

The FDA’s Medical Device Reporting guidance explains these manufacturer obligations. A complaint without an injury can still describe a reportable malfunction, so “no patient harm” is not an adequate reason to close the reporting assessment.

Medical device manufacturers should therefore document when they became aware of an event, the reporting decision, its rationale and any required follow-up. Certain corrections and removals have separate reporting requirements under 21 CFR Part 806. Device-specific surveillance or postapproval obligations may also apply.

OMC Medical’s overview of FDA postmarket surveillance planning explains how these activities fit into a broader monitoring process. The operational goal is to connect field information to risk management and corrective action, rather than maintain isolated reporting files.

Build an evidence-based US compliance review

Medical device compliance in the US is easier to manage when each obligation has an owner, a documented rationale and objective evidence. A regulatory checklist is useful only if it reflects the actual device and business model.

Medical device manufacturers can organize a focused review around five workstreams:

• Regulatory status: Confirm intended use, product code, classification, exemptions and the required marketing pathway.

• Quality-system operation: Map applicable QMSR and ISO 13485 requirements to procedures, records and process owners.

• Establishment obligations: Check registration, listing, facility roles and US-agent arrangements where applicable.

• Product controls: Review technical evidence, labeling, UDI, supplier controls and validation requirements.

• Postmarket readiness: Test complaint escalation, MDR decisions, corrections and removals, corrective action and change assessment.

Prioritize gaps by patient risk and regulatory consequence. Missing validation for a critical production process calls for a different response from an outdated procedural reference.

For FDA medical device compliance, assess both documentation and execution. Trace a recent design change, supplier change or complaint through the system and check whether required decisions were made and recorded. Preserve original records and document remediation transparently rather than backdating evidence to make a file appear complete.

Connect market access with ongoing compliance

For medical device manufacturers, US compliance requires alignment between regulatory status, quality-system operation and postmarket performance. Classification determines the starting point, but maintaining compliance depends on controlled processes and evidence throughout the product lifecycle.

OMC Medical supports product classification, registration, technical documentation and postmarket vigilance. Its FDA regulatory consulting services can help companies assess applicable requirements and organize a device-specific compliance plan.