What changed with the QMSR
The Quality Management System Regulation is FDA's updated quality system rule for medical devices. Published as a final rule in February 2024, it took effect on February 2, 2026, replacing most of the former Quality System Regulation in 21 CFR Part 820. The QMSR incorporates the international standard ISO 13485:2016 by reference, with some FDA-specific additions and clarifications.
For device manufacturers, the practical effect is closer alignment between FDA expectations and the ISO 13485 systems many companies already run for other markets. For distribution, it reinforces something that was already true: manufacturers are responsible for controlling outsourced processes and suppliers whose work affects product quality.
A 3PL that receives, stores, handles and ships finished devices affects product quality through storage conditions, damage, mix-ups and traceability. That generally makes it a supplier that your quality system needs to control.
Supplier controls applied to a 3PL
ISO 13485 requires a manufacturer to establish criteria for evaluating and selecting suppliers, based on their ability to provide product or services that meet requirements and proportionate to the risk associated with what they provide. It also requires monitoring supplier performance and re-evaluating suppliers.
Applied to a 3PL, that usually means:
- An initial evaluation, such as a questionnaire, document review and on-site or remote audit
- A documented approval decision recorded in your approved supplier list
- A quality agreement that defines responsibilities
- Ongoing monitoring of performance metrics, deviations and complaints
- Periodic re-evaluation and re-audit based on risk
The depth of control should match the risk. A 3PL handling sterile implants and refrigerated IVDs warrants deeper controls than one handling ambient Class I accessories. Document your rationale either way.
What belongs in the quality agreement
The quality agreement turns supplier control into specific, auditable responsibilities. For a distribution partner, it typically covers:
- Scope: products, sites and activities covered
- Receiving inspection and discrepancy handling
- Storage conditions, monitoring and excursion reporting
- Lot, serial and expiry capture and FEFO allocation
- Holds, quarantine and release authority
- Nonconforming product identification and segregation
- Returns handling and complaint handoff
- Recall support and timelines
- Change notification for sites, systems, subcontractors and key processes
- Training, records, retention and data transfer
- Audit rights and corrective action process
The agreement should say who decides, not just who acts. In nearly every case, disposition decisions about product quality belong to the manufacturer, while the 3PL executes and documents.
Nonconformance, deviations and CAPA
Things go wrong in every warehouse: a mis-pick, a damaged pallet, a temperature excursion, a lot received under the wrong number. Under your quality system, what matters is that these events are identified, documented, investigated where appropriate and corrected.
Your 3PL should report deviations that affect your product within an agreed timeframe, with a description, the product and lots involved, immediate containment and a proposed correction. Recurring or significant issues should go into a corrective and preventive action process, either the 3PL's own CAPA system feeding into yours or a joint process defined in the quality agreement.
Watch out for providers that underreport. If a year passes with no deviations reported on a busy account, that is more likely a reporting gap than perfect performance. Healthy reporting is a sign of a healthy quality culture.
Complaints and returned product
Complaint handling is a manufacturer obligation under the QMSR and ISO 13485, and many complaints first surface in distribution. A hospital returns a device that failed during a procedure. A patient returns a monitor that gave inconsistent readings. A clinic reports damaged packaging on a sterile product.
Your 3PL must recognize these as potential complaints rather than as routine returns. The quality agreement should define what triggers a complaint handoff, what information goes with it, such as order, consignee, lot, serial, photos and the customer's description, and how quickly it reaches your team.
Your team then evaluates the complaint, investigates as required and decides whether it is reportable under Medical Device Reporting rules in 21 CFR Part 803. The returned unit stays in quarantine, preserved for investigation, until you decide its disposition.
Audits and ongoing monitoring
Supplier audits are the main way to verify that what the quality agreement says is what actually happens. A useful 3PL audit goes beyond a document review. Walk the receiving dock and watch lots being captured. Pick a recent shipment and trace it back to receipt. Ask to see a hold applied and verify that it blocks allocation. Review temperature records and excursion reports. Check training records for staff working your account.
Between audits, monitor performance with a small set of metrics agreed in advance, for example inventory accuracy from cycle counts, deviations reported, complaint handoff timeliness, excursions and order errors. Review them in a regular business review.
Also confirm that your 3PL will support FDA or notified body inspections of your company where distribution records are requested, and that they will notify you if a regulator inspects their facility.
Certification versus capability
Some 3PLs hold ISO 13485 certification for their distribution activities, and certified operations are available in some markets. Certification can be a useful signal, because it means an accredited registrar has audited the provider's quality system against the standard.
Certification is not required for a provider to be an acceptable supplier, and it is not a substitute for your own supplier controls. The QMSR expects you to evaluate the supplier based on the risk of what they do for you. A certified provider still needs a quality agreement, monitoring and periodic re-evaluation, and an uncertified provider can be qualified if their controls meet your requirements and you document the basis.
When comparing providers, focus on demonstrated capability: traceability you can see, holds that work, excursion procedures that defer to your quality team and documentation you can audit.
Frequently asked questions
When did the QMSR take effect?
FDA's Quality Management System Regulation took effect on February 2, 2026. It incorporates ISO 13485:2016 by reference and replaced most of the former Quality System Regulation in 21 CFR Part 820.
Does my 3PL need to be ISO 13485 certified?
Not necessarily. Certification can be a useful signal, but the QMSR expects you to evaluate and control suppliers based on risk, and an uncertified provider can be qualified if their controls meet your requirements.
What should a quality agreement with a 3PL include?
It should cover scope, receiving, storage conditions, traceability, holds and release authority, nonconforming product, returns and complaints, recall support, change notification, records and audit rights.