MedTech 2026: How FDA QMSR Convergence and EU MDR Audits Are Reshaping Hardware Traceability
The FDA Quality Management System Regulation final rule, published in February 2024, takes effect February 2, 2026. It replaces the 1996-era Quality System Regulation with a framework explicitly aligned to ISO 13485:2016. For medical device manufacturers selling into both the US and the EU, this is the most consequential regulatory convergence in two decades. It also exposes which companies have real traceability infrastructure and which are running on documentation theatre.
What the QMSR Actually Changes
The QMSR keeps the FDA's existing inspection authority but harmonizes the substantive requirements with ISO 13485. The practical effect is that a single quality management system can satisfy both regimes, eliminating the duplicate documentation burden many manufacturers carried under the previous framework.
The catch is that ISO 13485 is more demanding than the old QSR in three specific areas. Risk-based thinking must be embedded throughout the QMS, not isolated to the risk management file. Design controls must demonstrate complete traceability from user need through verification and validation. Post-market surveillance must feed back into design and risk artifacts as a closed loop, not as a separate complaint database.
For manufacturers who ran their QSR compliance on a parallel quality system disconnected from engineering, the QMSR transition is painful. The traceability gaps that the old QSR tolerated will fail under QMSR audit.
The MDR Notified Body Reset
In parallel, EU MDR notified bodies have tightened their audit posture significantly through 2025. Several notified bodies (BSI, TÜV SÜD, DEKRA) have published guidance making clear that traceability gaps in the technical documentation are now treated as major non-conformities rather than observations. A May 2025 MedTech Europe survey found that the average MDR audit cycle now identifies 4.2 major non-conformities per audit, up from 1.8 in 2022.
The most common findings involve traceability breaks: a design change that did not propagate to the risk file, a verification test that referenced a superseded specification, a CAPA that closed without updating the affected technical documentation. These are exactly the failure modes a document-based quality system produces under load.
The Convergence Requirement
The convergent requirement under both QMSR and MDR is a quality system that operates on the same artifacts as the engineering team, with traceability as a structural property rather than a manual reconciliation activity.
In practice, this means the user need, the design input, the design output, the verification, the validation, the production specification, the post-market complaint, and the CAPA must all be nodes in a single connected graph. A change to any node flags the impact on every other connected node. The technical documentation file is a projection of the live graph at a point in time, not a parallel dataset.
This architecture is not theoretical. Several Class IIb and Class III medical device manufacturers, including French companies in the surgical robotics space, have moved to graph-based engineering platforms specifically to pass MDR audits without months of dossier preparation.
The Predetermined Change Control Plan Lever
The FDA finalized its Predetermined Change Control Plan guidance in October 2025. The PCCP allows a manufacturer to pre-clear classes of post-market changes if they can demonstrate a deterministic infrastructure for managing those changes safely.
The PCCP is a major operational lever for manufacturers shipping AI/ML-enabled devices, since it allows model updates without a new submission for each one. But the eligibility criteria are strict: the manufacturer must demonstrate a quality management system capable of executing the predetermined changes, evaluating their impact, and documenting them with full traceability, in real time.
Manufacturers running on document-based QMS cannot satisfy these criteria. Manufacturers running on graph-based engineering and quality systems can.
What MedTech Teams Should Do Now
The QMSR effective date is February 2, 2026, which is past for any team reading this. The first move is gap assessment against ISO 13485 traceability requirements. The second move is structural: any QMS that lives in a parallel system from engineering will fail audit within two cycles. The third move is platform consolidation: pick an engineering backbone that holds the QMS artifacts as connected nodes, not as a downstream dataset.
Koddex was built for this convergence. Design controls, risk management, verification evidence, and post-market data live in the same graph. QMSR and MDR audits become queries against the current state, not dossier preparation marathons that consume the team for months.
