Team Elexes 
Compliance Assurance
Stay compliant with industry regulations and standards.
Cost-effective
Achieve regulatory success with Elexes, all within your budget.
A medical device quality management system should do more than organize procedures. It should define how your organization makes decisions, controls product and process risks, maintains reliable evidence, responds to quality problems, and meets the obligations of every market it serves.
The correct QMS is not simply based on the size of the business entity alone. There are many other factors that need to be considered in determining which controls are required and how they need to function within your organization.
Elexes supports medical device manufacturers, startups, specification developers, software companies, suppliers, and other regulated organizations with QMS establishment, implementation, maintenance, remediation, and audit readiness. Our approach focuses on building a system that works in practice, not one that exists only as a collection of documents.
What Is a Medical Device Quality Management System?
A medical device quality management system is the controlled framework an organization uses to manage responsibilities, processes, resources, records, product realization, performance monitoring, and improvement across the device lifecycle.
An effective QMS connects quality activities that are sometimes managed separately:
⦿ Management responsibility and quality objectives
⦿ Document and record control
⦿ Training and competence
⦿ Design and development controls
⦿ Risk management
⦿ Supplier qualification and monitoring
⦿ Production and process controls
⦿ Equipment and infrastructure
⦿ Validation and verification
⦿ Complaint handling and regulatory reporting
⦿ Nonconformity and CAPA
⦿ Internal audits and management review
⦿ Post-market feedback and change control
These processes need to work together. A complaint may reveal a design, labeling, supplier, manufacturing, software, usability, or training issue. A CAPA cannot be assessed properly if the underlying records are incomplete. A design change cannot be approved responsibly without considering risk, verification, regulatory impact, and affected QMS documentation.
This is why establishing a medical device QMS is not simply a procedure-writing exercise.
When Does an Organization Need QMS Support?
Organizations seek medical device quality system support at different stages and for different reasons.
A startup might have to create its first QMS while developing its products. An experienced manufacturer will require preparation for ISO 13485 certification, compliance with FDA QMSR regulation, entering into an MDSAP market, addressing issues raised by an audit, or modifying the system due to a change in technology.
Support may also be needed when:
⦿ Responsibilities are unclear across internal teams and outsourced partners
⦿ Procedures exist, but implementation records are inconsistent
⦿ Design history and risk-management evidence have developed separately
⦿ Complaint, CAPA, supplier, and change processes are not connected
⦿ The organization is preparing for an internal, certification, MDSAP, customer, or regulatory audit
⦿ A new market introduces additional regulatory requirements
⦿ The QMS no longer reflects current products, processes, sites, or organizational roles
⦿ Quality activities depend heavily on one individual rather than controlled processes
⦿ Recurring findings indicate that corrective actions are not addressing systemic causes
A focused Medical Device QMS Gap Assessment can be useful for identifying missing controls, those that are partially in place, not working properly, or outdated prior to any implementation/remediation efforts.
Which QMS Frameworks Apply?
Medical device companies may encounter several quality frameworks. They are related, but they are not interchangeable.
ISO 13485:2016
ISO 13485:2016 is the central international QMS standard developed specifically for organizations involved in the medical device lifecycle. It provides a medical-device-focused framework for consistently meeting customer and applicable regulatory requirements.
At a high level, its auditable requirements are organized across Clauses 4 through 8:
This area addresses the organization’s QMS processes, required documentation, document control, record control, and the management of processes performed by external parties.
Quality policy and objectives should be established by leadership, responsibilities and authorities determined, focus on the customer and regulations maintained, and review of the suitability and effectiveness of the QMS conducted.
Organizations must provide the people, competence, infrastructure, and controlled work environment needed to perform activities that affect product quality.
This covers planning and controlling activities associated with the product lifecycle, including customer-related processes, design and development where applicable, purchasing, production, service provision, and monitoring or measuring equipment.
It is imperative that the QMS contains ways to gather feedback, deal with complaints, manage non-conforming products, perform audits, analyze data, and take necessary actions. The application of individual controls still depends on the organization’s role and activities. A legal manufacturer with design responsibility will not have the same operational scope as a component supplier or service provider.
FDA Quality Management System Regulation
For medical device manufacturers subject to US requirements, the FDA’s Quality Management System Regulation is contained in 21 CFR Part 820.
The QMSR was enacted on February 2, 2026. The QMSR references the ISO 13485:2016 standard, but maintains and includes FDA-specific requirements that are necessary to ensure that the requirements referenced comply with other relevant US medical device laws. The adherence to the QMSR is a legal requirement for organizations under the QMSR’s scope. It is not an ISO 13485 certification.
Manufacturers should therefore assess both the incorporated ISO 13485 requirements and applicable FDA-specific requirements, including the connections between the QMS and other US regulatory obligations.
Medical Device Single Audit Program
The Medical Device Single Audit Program (MDSAP) allows a recognized Auditing Organization to conduct a single regulatory audit that addresses the requirements of participating regulatory authorities.
MDSAP is based on ISO 13485 and incorporates applicable regulatory requirements from Australia, Brazil, Canada, Japan, and the United States. Its process-based audit approach examines management; measurement, analysis, and improvement; design and development; production and service controls; and supporting activities such as purchasing.
The market impact of MDSAP differs by jurisdiction, so an organization’s QMS and audit strategy should be planned around its actual market-access obligations.
ISO 9001:2026
ISO 9001:2026 is a general quality management standard that can apply across sectors. It may be relevant to a medical device organization’s broader business system or to suppliers working across several industries.
However, ISO 9001 does not replace ISO 13485, FDA QMSR, MDSAP requirements, or other medical-device-specific regulatory obligations. Organizations operating an integrated management system should clearly map which processes address general quality objectives and which controls are required specifically for medical devices.
How a Medical Device QMS Is Implemented
QMS implementation should follow the organization’s real operations rather than beginning with a generic library of procedures.
1. Assess the Current State
This is followed by the determination of the company’s role, products, markets, sites, outsourced activities, current approvals, and current state of the quality system. The gap assessment follows after comparing the current status with the relevant requirements.
4. Implement the Processes
Implementation entails task assignment, training, process execution, documentation, addressing the shortcomings of legacy systems, and ensuring appropriate control of outsourced processes.
2. Design the QMS Structure
QMS Architecture must include definition of process ownership, process interfaces, documentation level, approval authority, record keeping, escalation processes, and measures of performance. The architecture should always be proportional to the organization while including all requirements.
5. Audit the Working System
An internal audit should examine objective evidence and process effectiveness, not simply confirm that procedures exist. Findings should be evaluated, corrected, and followed through before a certification, MDSAP, customer, or regulatory audit.
3. Develop or Update Controlled Documentation
Policies, procedures, work instructions, forms, templates, and records should reflect how work is actually performed. Documentation needs to establish clear controls without creating unnecessary administrative layers.
6. Maintain and Improve
The QMS should change according to any changes in the product, in markets, suppliers, complaints, CAPA, regulations, business growth, and post-market information. The maintenance of the QMS needs clear ownership, control, review, and action.
What Changes the Scope of Your QMS?
Two medical device companies can follow the same standard and still require significantly different controls.
Organization Role
The legal manufacturer, specification developer, contract manufacturer, critical supplier, software developer, distributor, and service provider may have different responsibilities. Outsourcing an activity does not automatically remove the organization’s responsibility to control it.
Device Type and Technology
Controls should reflect the device. Software and AI/ML products may require software-lifecycle, configuration, release, cybersecurity, data, and change controls. Sterile devices may require validated sterilization and environmental controls. Implantable, reusable, measuring, or IVD products introduce other product-specific considerations.
Markets
Each jurisdiction may introduce requirements for registration, reporting, records, traceability, representatives, vigilance, inspections, or audits. A certification scope alone does not define every market obligation.
Risk and Lifecycle Stage
The maturity and depth of the QMS should support the organization’s current activities. Early development requires controlled design, risk, supplier, and change practices. Commercial-stage operations require functioning complaint, post-market, production, nonconformity, CAPA, audit, and management-review processes.
Outsourced Activities
Manufacturing, sterilization, testing, software development, warehousing, servicing, and other outsourced processes require appropriate qualification, agreements, oversight, records, and performance monitoring.
Medical Device QMS Services
QMS Establishment and Implementation
For organizations building a new system, Elexes can support QMS scoping, gap assessment, process architecture, documentation development, implementation planning, training, and readiness evaluation.
QMS Gap Assessment
A gap assessment reviews both documented controls and implementation evidence. The output should distinguish absent requirements from processes that exist but are inconsistently followed or ineffective.
QMS Remediation
Remediation may involve isolated findings or broader weaknesses across documentation, responsibilities, records, CAPA, complaints, suppliers, design controls, production, training, or management oversight.
Effective remediation addresses the underlying system problem rather than treating every observation as a standalone document correction.
Audit Readiness
Audit readiness includes confirming scope, reviewing objective evidence, conducting internal audits or focused mock assessments, correcting identified gaps, preparing process owners, and making records readily retrievable.
Readiness does not guarantee an audit outcome. It helps the organization identify and address preventable weaknesses before formal assessment.
Ongoing and Outsourced Quality Support
Some organizations require continued support to maintain their QMS, monitor action items, manage periodic activities, update documentation, review records, support management review, or provide additional quality capacity.
The responsibilities retained by the organization and those supported by Elexes should be clearly defined. The manufacturer remains responsible for its products, regulatory obligations, approvals, and final quality decisions.
How Elexes Supports Medical Device QMS Development
Elexes begins by understanding what the organization does, where it operates, which products and processes fall within scope, and what evidence already exists.
Support can include:
⦿ QMS applicability and scope assessment
⦿ ISO 13485 and FDA QMSR gap assessments
⦿ QMS architecture and process mapping
⦿ Documentation development and review
⦿ Implementation planning and process-owner support
⦿ Training and competence frameworks
⦿ Design-control and risk-management integration
⦿ Supplier and outsourced-process controls
⦿ Complaint, nonconformity, and Complaint Handling
⦿ Post-market controls
⦿ Risk Management and change-control alignment
⦿ Supplier Controls
⦿ Design Controls
⦿ Internal audits and management-review support
⦿ Certification, MDSAP, customer, and regulatory audit readiness
⦿ QMS remediation and ongoing maintenance
The objective is to create a practical route from identified gaps to implemented controls and sustainable evidence. Recommendations are tailored to the organization’s responsibilities, device risks, markets, and available resources.
Assess Your Medical Device QMS Readiness
Use the Medical Device QMS Readiness Checklist to conduct an initial review of governance, documentation, management responsibility, competence, product realization, risk, suppliers, production, complaints, CAPA, audits, and ongoing improvement.
The checklist is intended to help your team identify where objective evidence is available and where further assessment or action may be needed.
Get Ready for a QMS That Will Function
Whether you are establishing your first QMS, preparing for ISO 13485 or MDSAP, assessing FDA QMSR readiness, addressing audit findings, or maintaining an established system, the first step is understanding where your controls and evidence stand today.
FAQs
Frequently Asked Questions!
Start by defining your organization’s role, products, markets, processes, sites, and outsourced activities. Conduct a gap assessment, design the process architecture, develop proportionate documentation, implement the controls, train personnel, generate records, and test the system through internal audits.
No. ISO 13485 certification is performed by a certification body, while FDA QMSR compliance is a US regulatory obligation for organizations within scope. Although the QMSR incorporates ISO 13485:2016 by reference, FDA-specific requirements and other applicable US regulations still need to be addressed.
No. The applicable processes and level of control depend on the organization’s role, device type, markets, risks, lifecycle stage, sites, and outsourced activities. The QMS should be appropriately scoped while addressing every applicable requirement.
Yes. It can involve gap assessment, planning for remediation, updating documentation, implementing processes, evidence evaluation, CAPA assistance, internal audits, and other audit readiness services. This will depend on the results and state of the existing QMS.
QMS review should be done using specified activities such as internal audits, management review, quality data evaluation, change control, CAPA, and regulation monitoring. Frequency will depend on various factors such as requirements, risk, performance, and other changes.
Quick Turn around
Experience timely results with our efficient services.
Confidentiality guaranteed
We offer 100% confidentiality understanding how critical the data is for you.
Elexes offer complete range of regulatory and compliance expertise, ensuring full-support in product development and post-market compliance. Get everything under one roof for your medical device!
Associated Regulatory Authorities.
We’ve More
Than 256+ Global
Clients
The Best RA & QA Consultants
Clients Testimonials
Amazing Feedback About Our Services
Tom Birney
CEO Masterlink, Arizona
“
Elexes gave us immense support. Their Knowledge and thoroughness were excellent. I look for all of these qualities in consulting firms
“
Diane Bryant
CEO Novasignal, Los Angeles
“Prompt and competent! Elexes should be your next regulatory consultant. Their timeline-based project plan expedited the process.
“
Daniel Kinsey
President ViDava, Florida
“Professional and easy to work with! They expedited CE Marking for our products and also created clinical evaluations, risk assessments, and provided testing/manufacturing advice.
“
Linda Pan
Sr. Exe Treedental, Hong Kong
“Having Elexes as our import-export expert was a great choice. Elexes' team answered all our questions and guided us through every step.
“
Joshua Mink
Manager Outset Medical, California
“Highly recommend Elexes! They always meet commitments and follow through on action items.
“
Michal Depa
CTO Jana Care, Massachusetts
“Highly recommended! They excelled at regulatory projects, and document control, and grasped our product's nuances quickly.
“
Philip McFerran
MD Blackrock Pharma, England
“Kudos to the Elexes team! They're always proactive and have provided invaluable support to us with import, labels, and registrations.
“
Samip Shah
VP Regulatory AliveCor, California
“Excellent communication, diligent work. There is a strong quality background and QMS norms expertise.
“
Elizabeth W
Owner Liz Inc., Arizona
“Accurate and amazing! Their regulatory-compliant fact sheets for multiple products enabled us to sell domestically and internationally without issues. Their work had an impressive turnaround time.
“
Kurt Sysock
CEO Radformation, New York
“Elexes is a go-to for all FDA regulatory and quality systems work. They outperformed every expectation!
“
Popular Clients
We’ve 200+ Global Premium Clients
Looking For Regulatory Assistance?
Let's Talk How We Can Help You?
