What is a QMS and why does quality management matter so much in medtech companies?

What is a quality management system (QMS)?

A QMS (quality management system) is the structured way a company works to make sure its products are made in a repeatable, controlled way, and that it can prove it. ISO 9000:2015, the standard that defines quality terminology, describes it as the part of an organization's management system that deals with quality.

In practice, a QMS is made up of:

• quality policy and objectives, a statement of what the organization aims for and how it measures it,
• processes and procedures that describe how the work is done, from design to complaint handling,
• responsibilities: who decides, who approves and who carries out the work,
• resources: competent people, infrastructure, work environment and suppliers,
• records that prove the processes ran as planned,
• monitoring and improvement mechanisms: audits, management reviews, corrective actions.

A QMS is not a set of documents in a binder. The documents record it, but the system is made of the people and processes that use those documents every day.

Why a QMS is more than good practice in medtech

In many industries, a quality management system is a business choice. In the medical device industry, it is a condition for entering the market and staying on it. A quality failure here does not end with a customer complaint: it can put patients at risk, trigger a recall or cost the company its certificate.

A well-functioning QMS serves three needs at once:

1. Patient and user safety. Controlled design, production and post-market surveillance reduce the risk that a defective device reaches use.
2. Market access. Notified bodies and regulators assess not only the device but also the system it is made in.
3. Business predictability. A company that knows where its data is and who is responsible for what introduces changes faster and goes through audits with less stress.

The legal requirement in the EU: Article 10(9) MDR

Regulation (EU) 2017/745 on medical devices (MDR) requires manufacturers to establish, document, implement, maintain, keep up to date and continually improve a quality management system. The system must ensure compliance with the regulation in a way that is proportionate to the risk class and the type of device.

The MDR sets out the minimum scope of the system. Among other things, it covers:

• a strategy for regulatory compliance, including the management of device changes,
• identification of the applicable general safety and performance requirements,
• management responsibility and resource management, including the selection and control of suppliers,
• risk management and clinical evaluation,
• product realization: planning, design, development, production and servicing,
• verification of UDI assignments,
• a post-market surveillance (PMS) system and the reporting of serious incidents,
• communication with authorities, notified bodies and customers,
• corrective and preventive actions and verification of their effectiveness,
• monitoring, data analysis and product improvement.

ISO 13485:2016: the standard that gives the system its structure

ISO 13485:2016 sets out requirements for the quality management system of organizations involved in the medical device life cycle. The standard itself is voluntary, but in practice it is the common language of the industry.

Its European version, EN ISO 13485:2016 as amended, is a standard harmonized with the MDR. Applying a harmonized standard gives a presumption of conformity with the requirements of the regulation that the standard covers. The extent of that coverage is described in the informative Z annexes of the European version.

The requirements of the standard are grouped into five main areas:

• Clause 4: quality management system, including control of documents (4.2.4) and control of records (4.2.5),
• Clause 5: management responsibility, including management review (5.6),
• Clause 6: resource management, including competence and training of personnel (6.2) and infrastructure (6.3),
• Clause 7: product realization, including design and development (7.3) and purchasing (7.4),
• Clause 8: measurement, analysis and improvement, including feedback (8.2.1), internal audit (8.2.4) and corrective and preventive action (8.5.2 and 8.5.3).

The US market: QMSR since February 2, 2026

Since February 2, 2026, the Quality Management System Regulation (QMSR), the amended 21 CFR Part 820, has applied in the US. The FDA incorporated the requirements of ISO 13485:2016 into it by reference, replacing the previous Quality System Regulation (QSR).

For manufacturers operating in both the EU and the US, this means one system based on ISO 13485 is easier to maintain for both markets. The FDA states clearly, however, that it does not require ISO 13485 certification, does not issue such certificates, and that holding a certificate does not exempt a manufacturer from FDA inspection. Some QMSR requirements also go beyond the standard itself.

Law, standard, good practice: how to tell them apart

When building a QMS, it helps to name the status of each requirement explicitly:

• Law: the MDR in the EU and 21 CFR Part 820 (QMSR) in the US. Binding requirements.
• Harmonized standard: EN ISO 13485. Voluntary, but gives a presumption of conformity for what it covers.
• Guidance: for example MDCG documents. They help interpret the law but do not replace it.
• Good practice and recommendations: industry and advisory solutions. Worth applying, but they do not have the force of a requirement.

ISO 13485 vs ISO 9001: what is the difference?

Both standards deal with quality management, but they have different goals. ISO 9001 is a general standard focused on customer satisfaction and continual improvement. ISO 13485 was written for the regulatory environment of medical devices.

The main differences in practice:

• Regulatory requirements at the center. ISO 13485 refers again and again to the applicable legal requirements and requires them to be built into processes.
• More documentation and records. The standard requires many processes to be documented and records to be kept that make it possible to reconstruct a device's history.
• Risk across the whole device life cycle. Risk management covers the safety and performance of the device, not only business risks.
• Maintaining effectiveness rather than growth. The emphasis is on a stable, effective system rather than on continual improvement as a goal in itself.
• Feedback instead of customer satisfaction. Signals from the market feed post-market surveillance and risk assessment.
• Validation of software used in the QMS. Clause 4.1.6 requires validation of software used in the quality management system, proportionate to the risk.

An ISO 9001 certificate does not replace ISO 13485 in medtech, and an ISO 13485 certificate does not replace meeting the requirements of the MDR.

What does this mean in practice? How an effective QMS works

A working QMS shows not in the number of procedures but in whether information flows between processes. A single event should start a chain of linked actions, with a record at every step.

The most common QMS problems in medtech companies

Problems rarely come from a company not having a system. More often the system exists, but its parts do not form a whole.

• Outdated document versions in circulation, for example a printed work instruction two revisions old.
• Scattered data: complaints, CAPA, training and suppliers in separate spreadsheets.
• CAPA closed without verifying effectiveness, even though the MDR and ISO 13485 require it.
• Training disconnected from changes: a procedure changes, but nobody assigns the training.
• Internal audits as a formality, with no real findings or actions.
• Management review without data, based on general impressions instead of indicators and trends.
• Weak supplier control, especially for outsourced processes.

Paper, files or an eQMS?

A QMS can be run on paper, in files and spreadsheets or in a dedicated eQMS. Each approach can meet the requirements; they differ in maintenance cost and the risk of error.

• Paper system: simple to start with, but hard to keep under version control, slow for signatures and cumbersome during audits.
• Files and spreadsheets: cheap and familiar to teams, but control of versions, permissions and change history depends on people's discipline, and links between areas have to be maintained by hand.
• eQMS: enforces approval workflows, versions documents automatically, records an audit trail and connects processes. It needs to be implemented, and as software used in the QMS it must be validated in line with clause 4.1.6 of ISO 13485.

The choice depends on the scale of the business, the number of devices, growth plans and target markets. As the number of changes and records grows, the cost of keeping everything consistent by hand usually grows faster than the cost of a tool.

How NexiMed supports this process

NexiMed is an eQMS and eDMS platform dedicated to medical device manufacturers working with MDR and ISO 13485. It helps an organization stay compliant, but the system on its own does not make a company compliant. Responsibility for processes and decisions stays with the manufacturer.

In the areas covered in this article, the platform offers these modules:

• QMS Documents: versioning of procedures and work instructions, configurable review and approval workflows, electronic signatures, notifications about new revisions and an audit trail,
• Training: training plan and register, and evaluation of training effectiveness,
• CAPA: corrective and preventive actions,
• Complaints & Post-Market Surveillance: handling market feedback as part of PMS,
• Internal Audits,
• Purchasing: supplier control,
• Technical Documentation: the device technical file linked to risk analysis.

Where to start with getting your QMS in order?

Whether a company is building a system from scratch or tidying up an existing one, a short inventory is a good starting point: