Recently, towards the end of a post about preemption and the FDA’s Current Good Manufacturing Practices (“cGMPs”) – also known as Quality Management System Regulations (“QMSRs”) − we noted a “significant change” last February. “[T]he FDA issued a final rule” that replaced all existing cGMPs “by incorporating by reference an international standard specific for device quality management systems.” The purpose of the FDA’s changeover was “harmonizing to align more closely with the international consensus standard for devices. Id.
Thus, as of February, 2026, the cGMPs are no more. They are now solely known as QMSRs, and the FDA no longer drafts them (and no longer has to bother with the niceties of the Administrative Procedure Act). Instead, the Agency has incorporated by reference the set of model medical device quality standards created by the International Standards Organization, specifically ISO 13485:2016:
The QMSR incorporates by reference the international standard, ISO 13485:2016, Medical devices – Quality management systems – Requirements for regulatory purposes and clause 3 of ISO 9000:2015, Quality management systems – Fundamentals and vocabulary. This allows U.S. medical device quality management system requirements to align with internationally recognized standards and reduce burden on regulated industry.
Incorporating by reference ISO 13485:2016 as the foundational quality management system framework for medical device manufacturers promotes consistency in design, production, and lifecycle controls across global markets and now specifically requires risk management.
Incorporating by reference the terms and definitions set forth in Clause 3 of ISO 9000:2015 supports a common understanding of quality management system fundamentals. However, to the extent any clause of ISO 13485 conflicts with any provision of the FD&C Act and its implementing regulations, the FD&C Act and/or its implementing regulations will control.
FDA, Quality Management System Regulation (QMSR) (updated Feb. 2, 2026). The FDA also has – but has yet to finalize – one of its infamous “draft guidances” concerning “Quality Management System Information for Certain Premarket Submission Reviews.” Among other things, this draft guidance makes clear that the QMSRs apply to PMA approved devices, and thus will be relevant to preemption. Id. at Introduction.
Ordinarily, a copy of ISO 13485:2016 would cost you it’s $250 a pop, payable in Swiss Francs, from the ISO’s website. But as our prior post helpfully mentioned, read-only copies are available for free here through ANSI (but you would have to register). We suspect (but aren’t sure) that the availability of free copies is required by the government’s incorporation by reference, since the same website also offers copies of other ISO standards that have been federally adopted. Ordinarily we would link directly to the document itself, but this one contains a copyright notice. While there may well be some law out there that forbids American citizens from being forced to pay for copies of the laws that they are supposed to follow, we aren’t going to be the guinea pigs, so you’ll have to download from the above link yourselves.
We did that and have reviewed the actual ISO standards, and have the following mostly preemption-oriented comments:
- The FDA’s incorporated by reference “requirements” for PMA (and related) devices are extensive, “including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices, and design and development, or provision of associated activities (e.g. technical support).” The inclusion of “associated activities,” such as “technical support,” should bring many if not all of the activities of “authorized representatives” within the ambit of the MDA’s broad “different from or in addition to” preemption clause, thereby closing a loophole that plaintiffs have exploited.
- The standard’s inclusion of “other” parties’ that supply “raw materials, components, subassemblies, medical devices, sterilization services, calibration services, distribution services, [and] maintenance service” should reinforce Biomaterials Access Act preemption and perhaps expand preemption to new entities, depending on whether the ISO creates binding “requirements” as to them.
- ISO 13485:2016 creates a “process approach” to device regulation, and “[a]ny activity that receives input and converts it to output can be considered as a process.” Thus, the FDA’s blanket incorporation by reference of this standard would seem to create a very broad basis for preemption.
- ISO 13485:2016 extends to a regulated entity’s “advisory notice” – “subsequent to delivery” – concerning the “use,” “modification,” “return,” or “destruction” of such devices. Thus, its requirements extend to DHCP letters and recalls.
- The definition of “labelling” (ISO 13485:2016 uses European spellings) is as broad as the FDA’s traditional definition: “label, instructions for use, and any other information that is related to identification, technical description, intended purpose and proper use of the medical device.”
- We’re not sure what to make of the standard’s application in multi-component off-label use situations. A “note” to the definition of “manufacturer” states: “Any person who assembles or adapts a medical device that has already been supplied by another person for an individual patient, in accordance with the instructions for use, is not the manufacturer, provided the assembly or adaptation does not change the intended use of the medical device.” But whatever it means, the incorporated requirements certainly extend to this situation, and thus should be preemptive.
- The definitions of “medical device” and “product” both expressly include “software.” We don’t know how that will influence, if at all, the common-law definition of “product,” but for preemption purposes, the incorporated requirements clearly extend to device software.
- ISO 13485:2016 includes a definition of “service”: “Service is the result of at least one activity necessarily performed at the interface between the supplier and customer and is generally intangible.” Services are not products for purposes of strict liability. The standard includes examples, but they are unhelpful, since none of the examples relate to medical devices.
- The standard’s “documentation” requirements are notably non-specific. Take, for example, the “medical device file” (4.2.3). That file is to include: a “general description of the medical device, intended use/purpose, and labelling, including any instructions for use,” product “specifications,” “specifications or procedures for manufacturing, packaging, storage, handling and distribution,” “procedures for measuring and monitoring,” “as appropriate, requirements for installation,” and “as appropriate, procedures for servicing.”
- The other ISO device requirements are just as generalized. For instance, “design and development inputs (7.3.3)” consist of “functional, performance, usability and safety requirements, according to the intended use,” “applicable regulatory requirements and standards,” “applicable output(s) of risk management,” “as appropriate, information derived from previous similar designs,” and “other requirements essential for design and development of the product and processes.” They are to “be reviewed for adequacy and approved.”
- One last example, since it arises frequently in preemption cases, is reporting to the FDA. Here is the sum total of the applicable ISO language (8.2.3):
If applicable regulatory requirements require notification of complaints that meet specified reporting criteria of adverse events or issuance of advisory notices, the organization shall document procedures for providing notification to the appropriate regulatory authorities. Records of reporting to regulatory authorities shall be maintained.
That’s it – “document” the “procedures.”
Actually, that’s not it. What’s most important is what we mentioned in the prior post: “[A]s part of the PMA process, the FDA actually examines the manufacturer’s proposed processes and then mandates (through premarket approval) what those processes must entail.” That’s how these general device requirements become specific to each device. The FDA reviews and approves exactly what and how each device manufacturer proposes to satisfy those general standards for each submitted device. That approval is preemptive.
The FDA’s online statement and draft guidance both reference “harmonization” with international standards. Whether that will have any impact on preemption, we don’t know, but it might create an additional argument for preemption of bizarre state-law duties that don’t harmonize with anything – such as the purported duty to innovate one’s products claimed in the pending Gilead litigation. The draft guidance states:
If FDA finds there has not been a demonstration that the methods used in, and the facilities and controls used for, manufacturing, processing, and packing a device conform to the QMSR, including because there is insufficient information submitted in the PMA, FDA is required to deny approval of the application under the Act.
Id. at p.3 (footnote omitted). This is further confirmation that the FDA reviews each of these things during pre-market approval, and thus that any divergent state-law requirements are preempted.
Like the former cGMPs, the QMSRs themselves do not specify the details of any of the processes that applicants for approval must use. To the contrary, they are intentionally very broad and capacious, allowing applicants to decide what each new device needs. For example, the guidance section on “design and development requirements” is four pages long and – like the ISO itself − does not contain a single specific requirement, leaving that choice to the applicant. Id. at 10-13. These contain requirements for “identification,” “description,” “traceability,” keeping “records,” “reviews,” and the like. While the applicant must “describe” “Any test methods, protocols, acceptance criteria, and as appropriate, statistical techniques with sample descriptions/sizes and supporting rationale,” id. at 11, the guidance never dictates what any of these items must be. That is reserved for individual PMAs. Thus, to our way of thinking, any attempt by a plaintiff to dictate specifics would necessarily be “different from or in addition to” what the QMSRs require, and therefore preempted. All of the other requirements listed in the FDA draft guidance are similarly general.
It will no doubt be a while before medical devices subject to the FDA’s new QMSR/ISO 13485:2016 regime start appearing in prescription medical product liability litigation, but it is never too early to start thinking about how these regulatory changes will affect our efforts to defend those devices when litigation inevitably reaches them.





