By Matt Casey ·

FDA QMSR Transition Checklist: What to Migrate, In What Order

FDA’s Quality Management System Regulation (QMSR, 21 CFR Part 820 revised) went into effect on February 2, 2026. Manufacturers have until February 2, 2028 to align. That sounds like enough time — but MES and QMS implementations routinely take 12–18 months to stabilize, which means manufacturers who start evaluating now are already inside the safe window. Those who start next year are not.

This post covers what actually changes in the QMSR transition, which records and controls are affected first, and how to sequence the migration to avoid creating compliance gaps.

What changed in QMSR vs. the 1996 rule

The biggest structural change is that QMSR incorporates ISO 13485:2016 by reference. FDA’s stated intent is to reduce regulatory divergence for manufacturers who sell globally. In practice, this means:

  • DHR (Device History Record) requirements are now more explicit about the content required — 21 CFR 820.184 maps closely to ISO 13485 §8.2.6
  • CAPA requirements now explicitly reference root-cause analysis methodology — 21 CFR 820.100 aligns with ISO 13485 §8.5.2
  • Risk management (ISO 14971) is now expected as a documented practice, not just a reference
  • Electronic signature and audit trail requirements under 21 CFR Part 11 remain unchanged and apply to all electronic records

If you were already ISO 13485 certified, most of the substance is familiar. The migration is primarily documentation alignment and gap-filling on edge cases like software validation (GAMP 5) and risk management formality.

Migration priority: what to tackle first

Priority 1: DHR and production record completeness

The DHR is the first record an FDA inspector looks at. Under QMSR §820.184, it must include:

  • The device master record (DMR) reference for each device produced
  • The dates of manufacture
  • The quantity manufactured and accepted
  • The acceptance records showing inspection and testing results
  • The primary identification label and labeling
  • The unique device identifier (UDI) for applicable devices
  • Any deviation or NCR records

If your DHR is currently a collection of paper travelers, test sheets, and Excel logs, migrating to auto-generated electronic DHRs is the single highest-leverage project you can start.

Priority 2: CAPA with root-cause documentation

FDA 483 observations in the post-QMSR period show increased citations for CAPA records that lack documented root-cause analysis methodology. “Investigation complete” with a free-text note is not sufficient. Inspectors are looking for a named methodology (5-Why, Fishbone, Fault Tree) and documented effectiveness verification.

If your CAPA system doesn’t enforce methodology selection and effectiveness verification, fix that before your next surveillance audit — not after.

Priority 3: Electronic signature identity binding

If you use electronic signatures on quality records, 21 CFR Part 11 §11.50 requires that every signature captures the signer’s printed name, the date and time, and the meaning of the signature. Many legacy QMS implementations capture a username and timestamp but omit the “meaning” field (e.g., “I hereby approve this document as meeting design specifications”). That gap is an observation waiting to happen.

Priority 4: Software validation documentation

If your MES or QMS is a computerized system, GAMP 5 validation documentation is expected. Class II/III manufacturers in particular should have IQ/OQ/PQ documentation on their production-critical software. This is often the largest underestimated effort in QMSR transitions — plan for it now if you’re evaluating new software.

The Greenlight Guru / MasterControl question

A common question during QMSR transitions is whether to upgrade the standalone QMS (Greenlight Guru, MasterControl, ETQ) or consolidate into a MES+QMS-in-one approach.

The structural argument for consolidation: QMSR §820.184 requires that the DHR reference actual production records — inspection data, genealogy, operations completed. If your QMS and MES are separate systems, you’re manually linking those records (or not linking them at all). An inspector who asks “show me the DHR for lot 42A” should be able to follow a single thread from the production order to the DHR to the CAPA to the corrective action. When that thread crosses two systems, gaps appear.

This isn’t a criticism of standalone QMS tools — they’re well-designed for document control. It’s a structural observation: QMSR’s expanded DHR requirements make the integration between production records and quality records more consequential than it was under the 1996 rule.

Common mistakes under time pressure

  1. Migrating documents first, controls last. Writing new SOPs for QMSR is fast. Building the supporting controls (enforced e-signatures, structured CAPA state machines, immutable records) is slower. Manufacturers who paper over the controls gap fail their first post-transition inspection.

  2. Treating ISO 13485 certification as QMSR compliance. ISO 13485 certification from your notified body does not automatically satisfy QMSR. The standards overlap substantially, but FDA audits are separate from ISO audits.

  3. Deferring software validation. If you implement new production software during the transition window and don’t complete GAMP 5 validation before go-live, you’ve added a compliance liability at the same time you’re trying to reduce one.

  4. Not testing the DHR generation workflow before a real audit. Run a simulated FDA audit on one production lot before your actual surveillance audit. Can you produce a complete DHR — with all signatures, genealogy, and NCR references — in under 4 hours? If not, you have a process problem.

What to look for in an MES during QMSR transition evaluation

  • Auto-generated DHRs with all 820.184 required fields
  • CAPA with enforced root-cause methodology and effectiveness verification
  • E-signatures designed for 21 CFR Part 11 §11.50 (printed name + datetime + meaning)
  • GAMP 5 validation package (IQ/OQ/PQ + traceability matrix)
  • Immutable records with SHA-256 hash for tamper evidence

Qontiv is designed for compatibility with these requirements. See the medical device module for detail on how each QMSR control maps to Qontiv capabilities. If you’re evaluating for a transition project, request a demo and we’ll run the session around your specific DHR and CAPA requirements.

← Back to blog Request a demo