Guides / Regulatory

The QMSR Took Effect in February. Here Is What It Changed About Your Machining Suppliers

September 23, 2026

The Quality Management System Regulation took effect on 2 February 2026. It amends 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, along with clause 3 of ISO 9000:2015 for terms and definitions. Where a clause of ISO 13485 conflicts with the FD&C Act or its implementing regulations, the Act controls.

Most of what has been written about it is aimed at quality managers and written by quality system consultants. Very little of it says anything useful about the machine shop that cuts your parts. That gap is worth closing, because the QMSR changed the supplier question in a way that is easy to get backwards.

The thing people get backwards

The QMSR does not regulate your machine shop.

It applies to finished device manufacturers who intend to commercially distribute a device. A shop that turns a bone screw and ships it to you is supplying a component. It is not a finished device manufacturer and the QMSR does not land on it.

What the QMSR did was change the rules that land on you about how you control that shop. The obligation did not move to the supplier. It stayed with you and changed its vocabulary.

This matters commercially, because a number of shops have spent 2026 marketing themselves as “QMSR compliant” or “QMSR certified”. Neither phrase means anything. There is no QMSR certification, and a component supplier is not in scope to be compliant with it in the first place. A shop using that language is either confused about the regulation or hoping you are. Neither is a great opening.

What actually changed for purchasing

Under the old Quality System Regulation, purchasing controls lived in 21 CFR 820.50. Under the QMSR, the purchasing requirements read from ISO 13485 clause 7.4.

The substance is closely related. The framing is not.

Old framing	ISO 13485 framing
Establish requirements suppliers must meet	7.4.1, criteria for evaluation and selection, proportionate to the risk of the purchased product
Evaluate and select on ability to meet requirements	7.4.1, plus monitoring and re-evaluation, and what you do when a supplier stops meeting them
Define purchasing data clearly	7.4.2, purchasing information; FDA’s MDSAP module says its auditors confirm a written agreement that the supplier notifies you of product changes
Acceptance of incoming product	7.4.3, verification of purchased product, scaled to the risk

Three practical consequences.

Risk proportionality is now explicit. You are expected to be able to say why the level of control you apply to a supplier matches the risk of the part it makes. Applying an identical qualification package to a Class III implant supplier and to the shop that machines an equipment bracket is not thorough. It is undifferentiated, and an investigator can read it as a file that was never actually thought about.

Change notification is a written agreement, not a courtesy. FDA’s MDSAP purchasing module says its auditors confirm a written agreement in which the supplier notifies the manufacturer of changes to the product. The module text we opened gives no clause number. Purchasing information is clause 7.4.2 according to the RAPS clause comparison table, and that table is the only basis for the number here. We did not read the ISO text, so we cannot say whether the standard requires the agreement in every case. Write it anyway: the supplier notifies you of changes to the purchased product before they are implemented, where those changes could affect conformity. In machining, “changes to the purchased product” quietly includes a moved sub-tier for passivation, a different coolant on a PEEK part, a new tool coating, a different bar supplier. If that sentence is not in your purchase agreement, it is not in your file.

Re-evaluation has to actually happen. Qualifying a supplier in 2023 and never looking again was always weak. Under a clause that names monitoring and re-evaluation, it is weak in writing.

What to do about your existing suppliers

You very likely do not need to re-qualify anyone from scratch. Four things are worth an afternoon each.

1. Read your own supplier files in ISO 13485 order. If an investigator follows clause 7.4 through your file, does the file answer in that order? The content is usually there. The structure often is not.

2. Write down the risk justification. For each machining supplier, one paragraph: what the part is, what it does in the device, and why the level of control you apply matches that. This is the single most common missing page.

3. Check that the change notification clause exists in writing. Not in the quality manual, in the agreement with the shop. Then check the shop has actually read it, because plenty have signed one and still moved a plating vendor without telling anyone.

4. Check the certificate scope, not the certificate. A current ISO 13485 certificate can be scoped to design only, assembly only or distribution only. The scope line has to name machining. This one predates the QMSR and it still catches people, so it is worth its own read.

What this changes when you go looking for a new shop

Two questions separate a supplier that has thought about this from one that has not.

“What would you tell me about before you changed it?” A shop that takes change notification seriously answers with a list: material supplier, heat treat or passivation sub-tier, the process route, major tooling changes. A shop that does not take it seriously answers “we’d let you know if anything major changed”, which is not an answer.

“What is on your certificate scope line?” A shop that knows its scope reads it out. A shop that sends you the certificate image and lets you find out is not being dishonest, but it has not thought about your problem.

Neither question is about certificates, price or machines. Both are about whether the shop understands that its job includes producing a file you can defend.

For the working steps behind the purchasing controls, read our guide to medical device supplier qualification.

A note on where this site stands

We are a matching service. We do not hold ISO 13485, we are not a registered device establishment, and nothing here is regulatory advice. We read the regulation because our job is to send you to shops that will not create a problem in your purchasing file, and because the marketing noise around the QMSR this year has been genuinely misleading.

What we check before a shop sees an RFQ preview, and what we deliberately do not check, is written out on how we check a supplier. Read it before you rely on anything we say.

See also: the 21 CFR 820 (QMSR) supplier controls reference page for the structure of the rule and the section to clause map.

Sources

• FDA, Quality Management System Regulation (QMSR)
• FDA, Quality Management System Regulation, Frequently Asked Questions
• ISO 13485:2016, Medical devices, Quality management systems
• FDA, MDSAP training module: Purchasing process

Standards and regulations change. Check the current text at the source before you rely on it in a submission.

Frequently asked questions

Keep reading

• EU MDR and Machined Components: The Documents to Request From Your Machining Supplier
• Supplier Change Notification: What a Machining Shop Must Tell You and What You Do With It