Key QMS Considerations For Your Medical Device Startup

By Jim Kasic, Boulder iQ

If you are in the medical device development industry, and selling your own devices, you likely know you need a quality management system (QMS). A QMS helps ensure that manufactured devices meet all required specifications, and are safe and effective, with the ultimate goal to protect patient health by minimizing risks of defects, errors, and recalls. It also helps assure consistent quality throughout the device’s development life cycle. 

With these goals in mind, a QMS should be helpful to the operations of a company. Unfortunately, more often than not, it can become bloated and unwieldy. Here, we’ll help you understand key QMS basics and provide information to help you make the right decision for your company.

ISO Standards, FDA Requirements

Questions — and confusion — abound on high-level requirements for a QMS, specifically on whether it needs to be compliant with ISO standards or FDA requirements. To answer the question, a brief summary of the evolution of the two organizations’ standards can be helpful.

Quality management systems have their roots in Good Manufacturing Practices (GMP), which focus on pharmaceutical manufacturing and product safety. Influenced by GMP, in 1987, the International Organization for Standardization (ISO) developed the ISO 9000 series, a collection of international standards that provided a broader framework for quality management across a variety of industries. In particular, ISO 9001 focused on the implementation of quality procedures to improve performance and better meet customer needs.

But because medical devices required more specific processes and procedures, ISO 13485 was born in 1996. Based on the ISO 9000 framework, ISO 13485 is the international standard detailing the requirements for quality management systems in the medical device industry. For developers, ISO 13485 is the medical device equivalent of the old ISO 9001 standard.

In addition to ISO standards are U.S. Food and Drug Administration (FDA) standards. The FDA’s Quality System Regulation (QSR), which first went into effect in 1997, is similar to ISO 13485, with specifics for the U.S. regulatory environment.

Looking ahead, the FDA published a final rule last year to align the QSR more closely with ISO 13485. The resulting Quality Management System Regulation (QMSR), which will go into effect in early 2026, looks to offer a more unified approach to quality management.

QMS Compliance

ISO 13485 certification, while internationally recognized as a standard, is not mandatory to sell medical devices in the United States. (Medical device companies must comply with all applicable FDA regulations.) ISO 13485 is mandatory to sell devices in Europe. Standards in most other countries are extremely close to ISO 13485 and view the standard as highly recommended if not explicitly required.

Practically speaking, most medical device developers generally follow ISO 13485, and have quality management systems that are in compliance with it. By doing so, they can receive a certification to the standard from several international notified bodies. Major notified bodies for medical devices include:

• British Standards Institution Group – United Kingdom, Netherlands
• TÜV SÜD – Germany
• TÜV Rheinland – Germany
• TÜV Nord – Germany
• TÜV Austria – Austria
• DEKRA Certification – Germany, Netherlands
• SGS Belgium – Belgium
• DNV GL (Now DNV) – Norway
• LNE/G-MED – France
• National Standards Authority of Ireland – Ireland
• Istituto Italiano del Marchio di Qualità – Italy
• CCQS Certification Services – Ireland

For countries that do not strictly adhere to ISO 13485 (including the United States), companies can make minor adjustments to their quality management systems to satisfy their country’s regulations.

QMS Functions

A QMS — whether strictly following ISO 13485 or a version with minor adjustments — has three main functions:

• Compliance: Per regulations, a device manufacturer must have in place and follow a QMS to ensure that its manufacturing processes and finished devices are compliant.

• Control: Think of this function in two parts. One is the approval portion. A QMS establishes a strict sign-off process for all documents, ensuring tight document control. For any document to change, it must receive approval and sign-off from designated stakeholders. The second part is about safe, or “controlled,” storage for all documents. A full audit trail assists with revisions. The level of control a QMS affords makes the decision-making process throughout device development more efficient and productive.

• Communication: In a QMS, communication is a three-part function with regard to time frame. It offers a way to communicate what has been done in the past, with secure, archived documents providing a history of every step in the development process. It communicates in the present, documenting all progress and actions. By saving information securely to reference, it facilitates future communications.

Types Of Quality Management Systems

A QMS is essentially a large, semi-relational database with full audit trail capability. With that in mind, we can group these systems into three types. Here are basic pros and cons of each.

1. Paper system: You are not required to have a computer-based QMS. It is possible to use a completely paper-used system. If you understand the regulations, you can create all the standard operating procedures for the QMS from scratch.

Pros

• Simple implementation
• No capital start-up costs

Cons

• Difficulty in storing, retrieving and providing an audit trail
• Time-consuming

2. Simple, online file-based system: It also is possible to use a system with files that reside in a digital file structure (such as Google Documents).

Pros

• Easier and less time-consuming than a full paper-based system
• Does not generate quantities of paper to track

Cons

• Requires as much time and effort as a paper-based system
• Difficulty in approving and signing off on documents, and maintaining an adequate audit trail, since the documents do not reside in a fully validated and controlled environment

3. Complete, dedicated relational database: Several software providers have created relational databases that incorporate all parts of a QMS. Known as an eQMS (electronic QMS), this type of software can range from an almost completely turnkey system to a completely customizable system.

Pros

• Assurance of staying compliant with designated regulations
• Efficient handling of document storage and changes; full audit trail
• Reasonable cost: The cost for a mostly turnkey system, where the user must only customize key parameters, can be just a few thousand dollars.

Cons

• High cost: The cost for a completely customizable system can be hundreds of thousands of dollars.
• Time to set up, implement, learn, and use

Core Components

Regardless of the type of QMS you prefer, an effective system must include:​

• Quality policy and objectives: The company’s leaders must establish a quality policy and overall quality objectives, and commit to following through on the investment (time, money, priorities) to implement the QMS. ​This includes creating and maintaining a work environment and structure necessary to achieve the objectives.​

• Process approach: The QMS you select should support a process approach to device development, manufacturing, and post-market surveillance. It needs to cover the entire device life cycle, from ideation through design, development, manufacturing, sterilization, shipping, and customer feedback.​

• Document control: All documents must be safely and securely stored, with consistent access controls in place. Approval and sign-off procedures must be clear, consistent, and enforced.

• Continuous monitoring and evaluation: The QMS must provide for data that measures and analyzes, and allows for improvement, with all processes. Identification of any risks is imperative, along with mitigation strategies.

Right-Size

When choosing a QMS, select one that is appropriately sized and complex for your business. It can be easy to get swept up with bells and whistles. In fact, a QMS can take on a life of its own, to the point where it can even hamper an organization’s ability to conduct the very business for which it has the QMS.

Keep the basic functions of a QMS in mind: compliance, control, and communication. Remember, too, that it is a tool, and at its core, a means to an end. In most cases, a key parameter to the selection of a system will be the size of your company. Larger, more complex organizations developing and managing multiple devices, or producing high volumes, will need greater scalability and more flexibility in a QMS. Smaller startups will do well with a streamlined, less-costly QMS that’s easily scalable. And companies producing devices with higher-risk classifications or more intricate designs will need a system with more exacting quality controls.

For early-stage startups, a good recommendation is to purchase an inexpensive, turnkey, relational database system. They can engage a knowledgeable expert to audit the system, customize it as needed and implement it. In general, it’s wise to do as little customization as possible. Still, companies need to realize that the work represents a sizable time commitment — one that typically reaches 200 to 300 hours.

In weighing options, think lean and focus on right-sizing for your company.

Integration

A QMS is about having the policies and procedures in place to make your device. It is not about including everything you need to do in your business. Accordingly, integration with accounting, marketing, sales, enterprise resource planning, customer resource management, and other business systems is generally not necessary.

A QMS also is not part of the regulatory framework. Think about it this way: A QMS is a requirement for everything you do to make your device, inside your doors. Regulatory is everything you do to comply with external agencies. Certainly, a complaint received from a user takes you down a path where you are communicating with a regulator. You may store these communications within a QMS complaints module, but it will remain primarily a regulatory matter.

Evaluate what each of your business systems is for and whether that function is part of quality management. You can keep your QMS more manageable and less expensive by maintaining the focus on its purpose.

Conclusion

Determining the right QMS depends on your company’s regulatory obligations, size, and needs. A QMS that meets your minimal requirements, yet is scalable and flexible, will provide the foundation to get your device to market as quickly as possible.

About The Author:

Jim Kasic is the founder and chairman of Boulder iQ. With more than 30 years of experience in the Class I, II, and III medical device industry, he holds more than 40 U.S. and international patents. His career includes experience with companies ranging from large multinational corporations to startups with a national and international scope. Kasic has served as president and CEO of Sophono, Inc., a multinational manufacturer and distributor of implantable hearing devices, which was acquired by Medtronic. He also was the president of OrthoWin, acquired by Zimmer-BioMed. He received a B.S. in physics and an M.S. in chemical/biological engineering from the University of Colorado, and an MBA from the University of Phoenix. He can be reached at jim.kasic@boulderiq.com or on LinkedIn.