Medical device manufacturing is the regulated production of devices, from catheters and surgical tools to implants and diagnostic instruments, under a quality management system, now FDA's QMSR harmonized with ISO 13485, with per-unit records, controlled environments, UDI traceability, and closed-loop corrective action. In this industry, the record is part of the product.
What separates device manufacturing from ordinary production is that every build must be provable. It is not enough to make a good device; you must be able to show, unit by unit, that it was made to an approved procedure by trained people on qualified equipment. That evidence is what an FDA investigator inspects and what protects a patient. This guide covers the 2026 QMSR change, the records that run a device plant, cleanrooms, UDI, and CAPA, and where a thin operating layer keeps all of it audit-ready.
What Changed with the QMSR in 2026?
On February 2, 2026, the FDA's Quality Management System Regulation (QMSR) took effect, amending 21 CFR Part 820 to incorporate the international standard ISO 13485:2016 by reference. In plain terms, the FDA's device quality rules and the global standard are now largely the same rulebook, rather than two overlapping ones. The regulation applies to finished device manufacturers that commercially distribute devices in the U.S.
For most manufacturers already certified to ISO 13485, the QMSR is more alignment than upheaval, but it does change how the FDA inspects, and it makes ISO 13485's language the operative text. The practical takeaway is that a device plant's quality management system is now the center of gravity for compliance, and electronic records inside it must still satisfy 21 CFR Part 11 for electronic records and signatures. Harmonization does not lower the bar on evidence; it standardizes what the evidence has to look like.
What Are the DMR and DHR?
Two records run a device plant. The Device Master Record (DMR) is the approved recipe, the full set of specifications, procedures, drawings, and quality criteria for a device. The Device History Record (DHR) is the per-unit proof, the record that a specific device or batch was actually built to the DMR, capturing who built it, on what equipment, with which lots of material, and what the inspection results were.
The DHR is where compliance lives or dies. An investigator does not take "we always do it right" on faith; they pull a DHR and check that every required step, signature, and result is present and consistent. A missing initial or an out-of-sequence step is a finding, even if the device is perfect. That is why device plants obsess over record completeness at the moment of build, a gap found weeks later usually cannot be honestly closed. Serial- and lot-level traceability is what ties each DHR to the materials and processes behind it.
An electronic DHR that is filled in as the build happens has a real advantage over a paper one: it can enforce sequence, require a signature before the next step unlocks, and refuse to let an out-of-spec value pass silently. That turns record-keeping from an after-the-fact transcription, where errors and omissions creep in, into a built-in check that catches a missed step while the device is still on the bench and the operator is still there to fix it.
Why Do Cleanrooms Matter?
Many devices, anything implanted, sterile, or sensitive to particulates, are built in cleanrooms, controlled environments where airborne particle counts, temperature, humidity, and pressure are held within tight limits. The international standard ISO 14644 classifies cleanrooms by the number of particles allowed per cubic meter, with lower ISO class numbers meaning cleaner air; device assembly commonly runs in ISO Class 7 or 8 spaces, with the most critical operations in cleaner rooms still.
A cleanroom only protects the product if its conditions are continuously monitored and recorded, because a pressure drop or a particle spike during a build can compromise every unit made in that window. So the environmental record becomes part of the DHR story: to release product, a plant must show the room was in spec while the device was made. That makes cleanroom monitoring another stream of evidence to capture at the source rather than reconstruct later.
How Does UDI Traceability Work?
Unique Device Identification (UDI) is the FDA system that gives most devices a standardized identifier on their label in both human- and machine-readable form, so a specific device can be identified through distribution and use. The UDI has two parts: a device identifier (DI) that names the make and model, and a production identifier (PI) that captures lot, serial, or expiration. The DI portion is submitted to the FDA's Global Unique Device Identification Database (GUDID).
UDI is where the plant's internal traceability meets the outside world: the same serial and lot the DHR records are what the UDI carries into the field, so a field issue can be traced back to the exact build. Getting the label right, content, format, and machine-readability, is a manufacturing task, not just a regulatory one, which is why device plants treat labeling as a controlled, verified process.
What Is CAPA, and Why Is It the Heartbeat?
CAPA, corrective and preventive action, is the closed-loop process a device plant uses to investigate problems, fix their root cause, and prevent recurrence. It is one of the most inspected parts of any device quality system, because it is where a plant proves it actually learns from complaints, nonconformances, and audit findings rather than just logging them.
| Regulatory fact | Detail | Source |
|---|---|---|
| QMSR effective date | February 2, 2026-21 CFR Part 820 incorporates ISO 13485:2016 by reference | FDA QMSR |
| Applies to | Finished device manufacturers that commercially distribute in the U.S. | FDA QMSR FAQ |
| UDI rule | Final rule published Sept 24, 2013; UDI in human- and machine-readable form, DI submitted to GUDID | FDA UDI System |
A weak CAPA system is the fastest route to a serious inspection finding; a strong one is disciplined corrective and preventive action with real root-cause analysis and verified effectiveness. The quality of a CAPA depends entirely on the quality of the underlying data, you cannot find a root cause in records that are incomplete or scattered, which is why audit-ready records and effective CAPA are the same project.
CAPA is fed from several inputs: customer complaints, nonconformances found in-process, internal and external audit findings, and trends in returns or field data. The discipline is deciding which of those actually warrant a formal CAPA, not everything does, and then closing the ones that do with evidence that the fix worked. A plant that connects its complaint handling, nonconformance records, and production data can see those trends early, before a pattern of small issues becomes a recall.
How Does a Device Move from Recipe to Released Product?
Every device follows the same controlled loop from approved recipe to released, traceable product.
- Start from the DMR. The approved specifications, procedures, and quality criteria define exactly how the device is built.
- Build to procedure. Trained operators build on qualified equipment in a controlled environment, following the released work instructions step by step.
- Record in the DHR. Each step, signature, material lot, and equipment ID is captured as it happens, the per-unit proof of conformance.
- Inspect and test. In-process and final inspection verify the device meets spec; nonconformances trigger a controlled disposition.
- Label with UDI. The device is labeled and its UDI verified, tying the physical unit to its record and to GUDID.
- Release and monitor. Quality reviews the complete DHR and releases the device; post-market complaints and returns feed CAPA and the next build.
How Do You Keep Records Audit-Ready?
The hardest part of running a device plant is not building the device, it is keeping every record complete, consistent, and instantly retrievable across the DHR, environmental logs, equipment qualification, and CAPA. When those live in separate systems, binders, and spreadsheets, "audit-ready" becomes a scramble every time an investigator or a notified body arrives.
A thin operating layer solves this by connecting the equipment, environmental sensors, and the paperwork a plant already runs and capturing the record at the source, so the DHR builds itself as the device is made, environmental conditions are logged automatically, and a full unit history can be pulled in minutes rather than reconstructed. Harmony does this without rip-and-replace on top of the systems a plant already has (see how the platform works), which also surfaces line performance the same way an OEE calculation and lean program would in any plant. The result is records that are audit-ready by default, and the data quality that makes real CAPA possible. The CLS case study shows what replacing paper records with live production data looks like in practice, and for machined components like implants and instruments, it connects to the same CNC machining discipline device makers already run.