How does RiskWatch handle the FDA QSR → QMSR transition (effective February 2026)?

FDA's Quality Management System Regulation (QMSR) final rule was published in 2024 and becomes effective February 2026, replacing the QSR after 28 years and incorporating ISO 13485:2016 by reference. RiskWatch ships with a QMSR transition checklist, a side-by-side QSR-to-QMSR mapping, and dual-mode scoring so manufacturers can run QSR + QMSR + ISO 13485 simultaneously through the cutover. Existing 21 CFR 820 evidence carries forward into QMSR scoring without rework.

Does RiskWatch cover EU MDR + IVDR technical files and Notified Body audits?

Yes. EU MDR (Regulation 2017/745) Annexes I + II + III + VII–IX and EU IVDR (Regulation 2017/746) are mapped to the controls library, with technical-file templates, GSPR mapping, clinical evaluation tracking, post-market clinical follow-up (PMCF) workflow, and Notified Body audit-response evidence in one trail. The EU MDR transition extension through 2027 and the IVDR staggered transition through 2028 are tracked as overlays.

How does RiskWatch handle ISO 13485:2016, the cross-mapped device QMS?

ISO 13485:2016 is the primary device-QMS standard and is now cross-referenced by FDA QMSR (incorporated by reference) and EU MDR / IVDR Notified Bodies. RiskWatch maps the 8 ISO 13485 clauses to FDA 21 CFR 820 / QMSR subparts and EU MDR Annex II technical-file requirements, so a single internal audit produces evidence usable for FDA inspection, Notified Body surveillance audit, and ISO 13485 certification body.

Does RiskWatch handle ISO 14971:2019 risk management for devices?

Yes. ISO 14971:2019 is built into the risk pillar with the full risk-management file structure (risk-management plan, risk analysis, risk evaluation, risk control, residual-risk evaluation, risk-management report). Post-market surveillance signals close the loop back into the risk-management file automatically, so 21 CFR 803 MDRs, EU MDR PSURs, and complaint trends update the file without manual reconciliation.

How does RiskWatch handle FDA Cybersecurity Premarket Guidance + SBOM submission?

The FDA Cybersecurity Premarket Guidance (2023), required for all cyber devices submitted to FDA, is built into the library, including SBOM (Software Bill of Materials) submission requirements, threat modeling, security-risk-management documentation, and post-market vulnerability monitoring. EU MDCG 2019-16 cyber guidance is tracked as an overlay so a single cyber risk-assessment file satisfies FDA + EU expectations.

How does RiskWatch handle post-market surveillance and MDR (21 CFR 803)?

21 CFR 803 Medical Device Reporting and EU MDR Articles 83-92 (PMS + PSUR + vigilance) are mapped to the post-market workflow. Complaints flow to investigation, MDR-decision logic surfaces 30-day vs 5-day reportable events, and trending feeds the ISO 14971 risk-management file + EU MDR PSUR cycle. The same vault produces FDA MDR submissions and EU PSURs from one continuous record.

Does RiskWatch cover UDI (Unique Device Identification, 21 CFR 830)?

Yes. FDA UDI under 21 CFR 830, GUDID submission workflow, EU UDI under EU MDR Article 27 (and Eudamed UDI module), and Health Canada UDI requirements are tracked as overlays. Device-master-record + DI / PI assignment + label evidence are captured in one trail so UDI compliance is continuous rather than reassembled at audit time.

How does RiskWatch handle Software-as-a-Medical-Device (SaMD)?

SaMD is a first-class device type. The library covers FDA's SaMD pathway, EU MDR Rule 11 software classification, IEC 62304 software lifecycle (with Class A / B / C safety classifications), and IMDRF SaMD risk categorization. Mobile, cloud, and AI/ML-enabled software devices are all in scope. Cybersecurity premarket evidence is captured continuously across the software lifecycle, not bolted on at submission time.

For Class II / III Device, IVD, SaMD + Combination Product Manufacturers

One platform for FDA QMSR, EU MDR + IVDR, and ISO 13485 + 14971 across every device family.

Q: What is compliance management software for medical device companies?

Compliance management software for medical device companies unifies FDA 21 CFR Part 820 QSR / QMSR (effective Feb 2026), EU MDR (Regulation 2017/745), EU IVDR (Regulation 2017/746), 21 CFR Part 11 electronic records, 21 CFR 803 MDR, 21 CFR 830 UDI, ISO 13485:2016 device QMS, ISO 14971:2019 risk management, IEC 62304 software lifecycle, IEC 62366 usability, FDA Cybersecurity Premarket Guidance, MDCG 2019-16, and ISO 27001 on a single survey-based platform. It replaces parallel device-QMS, CSV / validation, EU MDR specialty, and cybersecurity-premarket tools with one Notified Body + FDA inspection-ready evidence trail.

Q: How long does medical device implementation typically take?

Most manufacturers go live in 30 days. Pre-built libraries for FDA 21 CFR Part 820 / QMSR, EU MDR, EU IVDR, ISO 13485:2016, ISO 14971:2019, IEC 62304, IEC 62366, FDA Cybersecurity Premarket Guidance, 21 CFR 803 MDR, and 21 CFR 830 UDI plus white-glove implementation handle the heavy lift. Multi-product-family, multi-site, and contract-manufacturer-heavy deployments add 2–4 weeks for scoping.

Medical device companies face the densest US + EU device-quality + cybersecurity regulatory stack of any sector. FDA 21 CFR Part 820 transitions to QMSR in February 2026. EU MDR + IVDR Notified Body audit cycles. ISO 13485:2016 device QMS. ISO 14971 risk management. IEC 62304 software lifecycle. IEC 62366 usability. FDA Cybersecurity Premarket SBOM submission. 21 CFR 803 MDR + 21 CFR 830 UDI. RiskWatch handles all of it as one survey-based assessment platform sized for Regulatory + Quality + V&V teams.

Start 30-day free trial Download the QMSR + EU MDR pack

Risk

Design · Post-market · Cyber

Compliance

FDA · EU MDR · IVDR

Quality

ISO 13485 · 14971 · 62366

One Score

94 / 100

Notified Body + FDA-ready posture

QMSR-ready

FDA QMSR · EU MDR · ISO 13485-readyLive

Trusted by Class II / III device, IVD, SaMD, combination-product, and contract manufacturers managing FDA QMSR, EU MDR, IVDR, ISO 13485, ISO 14971, FDA Cybersecurity Premarket Guidance, post-market surveillance, and UDI across design, V&V, manufacturing, and post-market operations.

4.8G2 Crowd·108+

4.7Capterra·76+

4.8Gartner Peer Insights·Voice of Customer

Why Regulatory + Quality + V&V Teams Pick RiskWatch

RiskWatch turns FDA QMSR, EU MDR, IVDR, ISO 13485 + 14971 into one program.

RiskWatch runs FDA 21 CFR Part 820 QSR / QMSR, EU MDR, EU IVDR, ISO 13485:2016, ISO 14971:2019, IEC 62304, IEC 62366, FDA Cybersecurity Premarket Guidance, 21 CFR 803 MDR, 21 CFR 830 UDI, and 21 CFR Part 11 as one program on one platform, scored against the same controls library, and tracked through a single Notified Body + FDA inspection-ready evidence trail. Built for device, IVD, SaMD, and combination-product manufacturers where one Regulatory + Quality team covers every regulator, every device family, and every audit cycle, without enterprise GxP-suite overhead.

FDA QMSR + EU MDR + ISO 13485 in one library

21 CFR Part 820 (transitioning to QMSR in Feb 2026) + EU MDR Annexes I + II + III + ISO 13485:2016 cross-mapped. Design controls, CAPA, MDR, technical-file evidence, and Notified Body audit responses share the same vault, no parallel binders.

ISO 14971 risk + cybersecurity SBOM built in

ISO 14971:2019 risk-management file, IEC 62366 usability files, IEC 62304 software lifecycle, and the FDA Cybersecurity Premarket Guidance 2023 (with SBOM submission) are tracked as overlays. Post-market surveillance feedback closes back into the risk-management file automatically.

Sized for Regulatory + Quality + V&V team scale

VP Regulatory + Quality + V&V director + post-market lead share one platform. Pre-built libraries cut prep time. White-glove implementation in 30 days, not 6 months.

The Medical Device Regulatory Landscape

Medical device compliance is multi-regulator. The numbers prove it.

FDA's Quality Management System Regulation (QMSR) becomes effective February 2026, replacing the QSR after 28 years and incorporating ISO 13485:2016 by reference. EU MDR (Regulation 2017/745) has been in force since May 2021 with transition extensions through 2027. EU IVDR (Regulation 2017/746) is in force with staggered transition through 2028. The FDA Cybersecurity Premarket Guidance (2023) now requires SBOM submission for all cyber devices. Each regulator wants its own evidence package.

QMSR

FDA Quality Management System Regulation, final rule effective Feb 2026 (replaces QSR)

FDA QMSR final rule

EU MDR

Regulation 2017/745, in force since 2021, transition extended through 2027 by amendments

EU MDR (Regulation 2017/745)

SBOM

FDA Cybersecurity Premarket Guidance (2023), requires SBOM in submissions for cyber devices

FDA Cybersecurity Premarket Guidance 2023

ISO 13485

Primary device-QMS standard cross-referenced by FDA QMSR + EU MDR Notified Body audits

ISO 13485:2016

Three Domains, One Platform

Medical device risk lives in three concrete domains

RiskWatch covers all three. Each domain has a dedicated workflow, scoring model, and remediation queue. They share data so a single design-control change satisfies 21 CFR 820.30 / QMSR, ISO 13485 §7.3, EU MDR Annex II technical-file requirements, and ISO 14971 risk-management file updates simultaneously.

Risk

Design + Post-market + Cybersecurity Risk

Survey-based risk assessment across ISO 14971 risk-management file, IEC 62366 usability, IEC 62304 software lifecycle, and FDA Cybersecurity Premarket SBOM, aligned to QMSR + EU MDR + IVDR.

ISO 14971 risk-management file evidence
IEC 62366 usability + 62304 software files
FDA cyber premarket + SBOM tracked

Explore Risk Management

Compliance

FDA QMSR + EU MDR + IVDR

FDA 21 CFR Part 820 QSR / QMSR, EU MDR (2017/745), EU IVDR (2017/746), 21 CFR 803 MDR, 21 CFR 830 UDI, and 21 CFR Part 11 in one cross-mapped library.

QMSR + EU MDR technical files captured
MDR (21 CFR 803) post-market workflow
UDI + Part 11 evidence ready

Explore Compliance Management

Quality

ISO 13485 + 14971 + 27001

ISO 13485:2016 device QMS, ISO 14971:2019 risk management, IEC 62366 usability, IEC 62304 software lifecycle, and ISO 27001 manufacturer infosec across every device family.

ISO 13485 QMS scoring continuous
Notified Body audit cycle ready
ISO 27001 manufacturer infosec

Explore Cybersecurity

The Coverage Gap

Most medical-device software covers one regulator

Device-QMS platforms cover design controls + CAPA + DHF. CSV / validation tools cover Part 11 + computer-system validation. EU MDR specialty covers technical files + Eudamed. Internal audit covers ERM. Cyber premarket covers SBOM. Each does one job. Regulatory + Quality teams still operate four parallel programs.

Platform Category	FDA QMSR	EU MDR	IVDR	ISO 13485	Cyber Premarket	Post-market
Device QMS PlatformsGreenlight Guru, Qualio, MasterControl	Yes	Partial	Partial	Yes	·	Partial
CSV / Validation ToolsValGenesis	Partial	·	·	Partial	·	·
EU MDR SpecialtyRegDesk, Eudamed-only tools	·	Yes	Partial	·	·	Partial
Internal Audit / ERMWorkiva, AuditBoard	Partial	Partial	Partial	Partial	·	·
Cybersecurity PremarketMedcrypt	·	·	·	·	Yes	·
Spreadsheets & Email	·	·	·	·	·	·
RiskWatchThe unified Notified Body + FDA inspection-ready platform	Yes	Yes	Yes	Yes	Yes	Yes

RiskWatch is the only platform covering all six medical-device compliance domains: FDA QMSR, EU MDR, EU IVDR, ISO 13485, FDA Cybersecurity Premarket Guidance, and post-market surveillance. Device-QMS platforms cover design controls + CAPA. CSV / validation tools cover Part 11. EU MDR specialty covers technical files. Cybersecurity premarket covers SBOM. Each does one job. RiskWatch unifies all six in one survey-based assessment workflow.

How It Works

One platform. Continuous compliance across every regulator.

RiskWatch is a survey-based assessment platform. The work is structured around questionnaires that capture design-control, manufacturing, validation, post-market, and cybersecurity posture in a consistent format, then scored against every framework you align to.

For medical-device manufacturers, that workflow runs continuously across FDA 21 CFR Part 820 QSR (transitioning to QMSR in February 2026), EU MDR Annexes I + II + III, EU IVDR, ISO 13485:2016, ISO 14971:2019, IEC 62304, IEC 62366, FDA Cybersecurity Premarket Guidance, 21 CFR 803 MDR, and 21 CFR 830 UDI. A single design-control update scores against 21 CFR 820.30, QMSR §820.30, ISO 13485 §7.3, and EU MDR Annex II technical-file requirements simultaneously.

The same platform runs all of it, surfaces gaps before Notified Body or FDA arrival, assigns remediation owners, and tracks completion. Replace the four parallel tools and the spreadsheet bridge between them.

The Workflow

01
Assess
Survey-based questionnaires capture design-control, manufacturing, validation, post-market, and cybersecurity posture across every device family, manufacturing site, and contract manufacturer.
02
Score
Responses score against your chosen framework: FDA 21 CFR Part 820 / QMSR, EU MDR (2017/745), EU IVDR (2017/746), ISO 13485:2016, ISO 14971:2019, IEC 62304, IEC 62366, FDA Cybersecurity Premarket Guidance, ISO 27001:2022, or custom.
03
Remediate
Gaps become assigned tasks. Owners get deadlines. Contract manufacturer + supplier + 3rd-party tasks cascade to the supplier portal automatically.
04
Audit
Evidence trails export to PDF, FDA inspection format, EU MDR technical-file binder, Notified Body audit response, or post-market surveillance report. Inspection-ready in minutes.

DesignManufacturingPost-marketCyberSuppliers

Built For Your Role

Who uses RiskWatch in a medical device company

VP Regulatory Affairs + Quality

Owns enterprise-wide RA + QA program, FDA + EU + Health Canada submissions, Notified Body relationships, and board-level quality posture.

QMSR + EU MDR + IVDR scoring continuous. ISO 13485 audit-ready. Board metrics + post-market signals surface from the same vault.

R&D Head + Director of Engineering

Owns design-control program (21 CFR 820.30 / QMSR §820.30 / ISO 13485 §7.3), DHF, and design-history-file integrity across product lines.

Design controls scored continuously. DHF backlog visible. Design-input + design-output traceability tracked through every change.

Director Validation + V&V

Owns process validation (IQ/OQ/PQ), software validation (IEC 62304), CSV (21 CFR Part 11), and verification + validation across device + production-equipment scope.

V&V evidence captured. CSV protocols + Part 11 audit trails ready. Validation-state visibility across every system + device.

FDA Liaison / Regulatory Submissions

Owns 510(k) / PMA / De Novo / IDE submissions, FDA correspondence, establishment registration, and listing, including the QMSR transition.

Submission-ready packages on demand. QMSR transition checklist tracked. FDA-483 + Warning-Letter response evidence at fingertips.

Director Cybersecurity (Premarket + SBOM)

Owns FDA Cybersecurity Premarket Guidance compliance, SBOM submission, MDCG 2019-16 (EU), threat modeling, and post-market cyber.

FDA cyber premarket evidence captured. SBOM tracked across components. Post-market cyber feedback closes into the risk file.

Director Post-Market Surveillance + MDR

Owns 21 CFR 803 MDR reporting, EU MDR Article 83-86 PMS + PSUR, complaint handling, vigilance, and post-market surveillance.

MDR + PSUR cycle continuous. Complaint-to-CAPA lineage tracked. Post-market signals close the loop on the ISO 14971 risk file.

Built For Your Segment

Medical device segments we serve

Class II Device Manufacturers

510(k) pathway moderate-risk devices under FDA 21 CFR Part 820 / QMSR + EU MDR Class IIa / IIb classification + ISO 13485 + ISO 14971 risk management.

Class III Device Manufacturers

PMA-pathway high-risk implantable + life-sustaining devices under FDA 21 CFR Part 820 / QMSR + EU MDR Class III + Notified Body audits + extended PMS.

IVD Manufacturers

In-vitro diagnostic device manufacturers under EU IVDR (Regulation 2017/746) + FDA CDRH IVD pathways + ISO 13485 + ISO 15189 lab-quality cross-mapping.

Software-as-a-Medical-Device (SaMD)

FDA-regulated software (mobile, cloud, AI/ML) under FDA SaMD pathway + EU MDR Rule 11 + IEC 62304 software lifecycle + cybersecurity premarket guidance.

Combination Product

Drug-device + biologic-device combination products under FDA 21 CFR Part 4 + 21 CFR Part 820 (device cGMPs) + 21 CFR Part 211 (drug cGMPs) cross-coordination.

Contract Device Manufacturers (CDM)

Contract design + manufacturing organizations under FDA establishment registration + ISO 13485 + client-imposed quality agreements + supplier-controls cascades.

Frameworks We Cover

Medical device frameworks built into the library

RiskWatch ships with pre-built libraries for every major US + EU medical-device regulation + ISO + IEC standard. Map controls once. Score against the framework that matters this audit cycle.

Regulatory Frameworks

FDA 21 CFR Part 820: QSR / QMSR (transitions to ISO 13485-aligned QMSR effective February 2026).
EU MDR: Regulation 2017/745, EU Medical Device Regulation, Notified Body + technical file regime.
EU IVDR: Regulation 2017/746, EU In-Vitro Diagnostic Regulation, staggered transition through 2028.
FDA 21 CFR Part 11: Electronic records + electronic signatures for device QMS systems.
FDA MDR (21 CFR 803): Medical Device Reporting, post-market adverse-event + malfunction reporting.
FDA UDI (21 CFR 830): Unique Device Identification system, labeling + GUDID submission.

Industry + ISO / IEC Standards

ISO 13485:2016: Medical-device QMS standard, cross-referenced by FDA QMSR + EU MDR + IVDR Notified Bodies.
ISO 14971:2019: Risk management for medical devices, required by FDA QMSR + EU MDR Annex I.
IEC 62366-1:2015+A1:2020: Usability engineering for medical devices, required by EU MDR + FDA HF guidance.
IEC 62304:2006+A1:2015: Medical device software lifecycle, applicable to software in / as a medical device.
FDA Cyber + MDCG 2019-16: FDA Cybersecurity Premarket Guidance 2023 (with SBOM) + EU MDCG 2019-16 cyber guidance.
ISO 27001:2022: Manufacturer information security management system, corporate infosec baseline.

Trusted by 1,500+ risk and compliance teams

We had four program owners running QMSR transition, EU MDR technical files, ISO 14971 risk, and FDA cybersecurity premarket on four different tools. Now it's one platform. QSR-to-QMSR readiness, EU MDR Annex II technical files, Notified Body audit response, ISO 14971 risk-management file, and SBOM submissions all run from the same evidence vault. Our last Notified Body audit produced two minor non-conformities instead of nine.

K. Rasmussen

VP Regulatory Affairs + Quality, Mid-cap Class II + III device manufacturer · 1,900 employees · 6 product families · FDA + EU + Health Canada in scope

4 → 1programs consolidated to one platform

9 → 2Notified Body non-conformities on most recent audit

30 daysfrom kickoff to first ISO 13485 + QMSR scoring live

Resources

Practical playbooks for Regulatory + Quality + V&V teams

Checklist

Frequently asked questions

Class II · Class III · IVD · SaMD · Combination

See RiskWatch run a QMSR + EU MDR + ISO 13485 cycle live

30-minute walkthrough of the medical-device library, your device-family + regulator inputs, and the single evidence-trail output. No slideware, no consulting upsell.

Book a 30-minute walkthrough Talk to a medical device specialist

Or call US: +1 941-500-4525