If you are a MedTech founder with a device still in development, QMSR is no longer a future problem. FDA's Quality Management System Regulation took effect on February 2, 2026, and it changes how your design controls will be read by an investigator, a notified body and, increasingly, an investor doing diligence.
The good news: FDA describes the new rule as substantially similar to the old Quality System regulation. The harder news: the lens is different. Inspections now start from product risk, internal audit and management review records are open to review, and the vocabulary of your design history file is expected to follow ISO 13485.
Here is what that means in practice for a startup team, and a checklist we use to get design controls QMSR-ready without building a quality bureaucracy you cannot afford.
What QMSR changed, in plain terms
The QMSR replaces most of the old 21 CFR 820 text by incorporating ISO 13485:2016 by reference. Design controls now live in the standard's Clause 7.3 (design and development) rather than the old 820.30. A few changes matter most for early-stage teams:
Records are open. FDA no longer exempts management review, internal audit and supplier audit reports from inspection. What you write in those reports is now evidence.
A new inspection model. FDA retired QSIT and now inspects under Compliance Program 7382.850, which, as The FDA Group summarizes it, follows product risk from design through post-market.
Risk is woven through everything. At FDA's January town hall, the agency made clear that risk management is how the quality system runs, not a separate file, and that ISO 14971 is not mandated but a systematic, documented process is (NSF summary).
Usability is in scope. ISO 13485 names usability alongside function, performance and safety when assessing design changes, which the old QSR did not spell out.
The early enforcement record confirms where FDA is looking. An FDA quality official told a May conference that risk management was the top Form 483 observation in the first QMSR inspections (RAPS). One of the first QMSR warning letters cited a firm for lacking procedures to control design changes and assess their significance (FDA Law Blog).
A QMSR design controls checklist for startups
You do not need a large quality department to meet the QMSR. You need design controls that are scaled to your device, started at the right time and connected to risk. We walk teams through these seven points.
1. Draw a clear line between research and design and development
FDA has said design controls do not cover feasibility and proof-of-concept work, but they must be in place before an IDE study. Write down the date and decision where formal design and development begins. An investigator, or an acquirer, should not have to guess.
2. Write a design and development plan you actually use
Clause 7.3.2 expects a plan with stages, reviews, verification, validation, transfer activities and responsibilities. Keep it short and update it at each phase gate. A plan that was written once for a binder and never touched again is a finding waiting to happen.
3. Tie every design input to a user need and a risk
Inputs should trace to user needs, intended use, applicable standards and the outputs of your risk analysis. When a hazard drives a requirement, show that link in your trace matrix. This is the thread an inspector pulls first under a risk-based model.
4. Make risk management a living file
The most common gap reported in early QMSR inspections is a risk file that was complete at design and never updated. Define who owns risk updates and what triggers them: bench failures, cadaver or animal study observations, supplier issues, design changes and, after launch, complaints.
5. Run design reviews with people who can challenge you
QMSR design reviews need qualified, objective participants. FDA framed independence as a matter of competence, not job title. For a five-person company, that often means bringing in an outside engineer or advisor for key gates and recording the questions they raised and how you closed them.
6. Control design changes from the first frozen design
Once you freeze a design for verification, every change needs a documented assessment of its effect on function, performance, usability, safety and regulatory status. Startups iterate quickly, so build a lightweight change form now rather than reconstructing decisions later.
7. Plan verification, validation and transfer together
Verification proves you built the device right; validation, including human factors where needed, proves you built the right device. Both feed design transfer to manufacturing. Planning them as one sequence avoids the classic gap: a validated design that cannot yet be built repeatably.
Where we see teams get stuck
Across programs in areas like steerable catheters, urology, orthopedics and heart assist, the QMSR-related problems we see are rarely about the regulation itself. They are about timing and habits:
Design controls started too late. Teams prototype for a year, then try to back-fill a design history file before a pre-submission or first-in-human study.
A risk file that lives with one person. When that engineer leaves, the reasoning behind key mitigations leaves too.
Templates bought, not adopted. An off-the-shelf QMS with procedures nobody follows is worse than a lean one the team actually uses, because inspectors can now read your audits.
Suppliers outside the system. Outsourcing and purchasing ranked near the top of early QMSR observations. Contract manufacturers and component suppliers need to be qualified and controlled, not just quoted.
Usability left for the end. With usability now named in design change assessments, user-interface decisions need to be tracked from the start.
How Birch Design helps
Birch Design is a medical device development and commercialization consulting firm based in Minnesota's Medical Alley, working with startups and growing MedTech companies across the U.S. Our founder has led devices through FDA pathways including preclinical studies, animal trials, first-in-human programs and 510(k)s, so we build design controls the way a development team actually works.
Our Product Development & Commercialization Readiness Assessment is a structured review of where your program stands and what to do next. For teams facing the QMSR, it covers your design and development plan, traceability from user needs to verification, the state of your risk file, design review practice and the gaps to close before your next milestone, whether that is a pre-submission, a first-in-human study or a raise. From there we can support design verification and validation, FDA strategy and program leadership as needed.
Start the conversation
If you are not sure whether your design controls would hold up under the QMSR, that is a good time to talk. Contact Birch Design or book a discovery call and tell us where your device is today.
Sources: FDA QMSR Frequently Asked Questions; NSF summary of FDA's January 14, 2026 QMSR town hall; RAPS (May 14, 2026); The FDA Group Insider (June 22, 2026); FDA Law Blog (August 12, 2026). This post is general information, not regulatory advice for a specific device.