The 2026 QMSR Transition: What Changed for CNC Shops
Regulatory Update — Effective February 2, 2026
The FDA's new QMSR replaces the Quality System Regulation (QSR / 21 CFR Part 820) by incorporating ISO 13485:2016 by reference. The requirements are "substantially similar," but the framework, terminology, and FDA inspection approach have changed.
Key implication for CNC shops: If your QMS was built solely around 21 CFR 820 language, your documentation (SOPs, validation protocols, DHR templates) needs updating to align with ISO 13485 terminology. Shops already ISO 13485-certified will find the transition minimal.
Process Validation vs Product Verification: The Core Decision
This is the single most important concept in FDA manufacturing: Can you inspect the quality into the final product, or must you build it in?
Product verification (21 CFR 820.90) means you can measure the critical characteristics on every finished part — dimensions, surface finish, material hardness — and accept/reject each unit individually. This applies to most CNC-machined components where 100% inspection is feasible.
Process validation (21 CFR 820.75) is required when inspection alone cannot verify quality — for example, the internal crystalline structure of a PEEK implant after machining, or the subsurface integrity of a titanium hip stem. If the quality attribute cannot be fully verified by testing the finished product, the process that creates it must be validated.
| CNC Operation | Verification or Validation? | Rationale |
|---|---|---|
| Dimensional machining | Verification (820.90) | Every dimension can be measured on CMM |
| Surface finish | Verification (820.90) | Profilometer measures Ra directly |
| PEEK crystallinity after machining | Validation (820.75) | Cannot be measured non-destructively on every part |
| Subsurface work-hardening depth | Validation (820.75) | Requires destructive cross-section testing |
| Thread depth and pitch | Verification (820.90) | Go/no-go gages verify every part |
| Residual stress from clamping | Validation (820.75) | X-ray diffraction testing is destructive |
IQ/OQ/PQ: The Three-Stage Machine Qualification
Installation Qualification (IQ)
Proves the CNC machine was installed correctly per manufacturer specifications. Run ONCE at initial installation.
Operational Qualification (OQ)
Proves the machine operates within specified limits across its full range. Tests machine capability, not part-specific results.
Performance Qualification (PQ)
Proves the machine can produce actual parts that consistently meet specifications under normal production conditions.
Device History Record (DHR) for CNC Operations
21 CFR 820.184 requires a Device History Record for each production unit (or lot). For CNC machining, this means every part must have traceable records linking:
- Material: Heat lot number, MTR (Material Test Report), incoming inspection results
- Process: Machine ID, program revision, operator ID, date/time stamps
- Inspection: In-process and final CMM data, surface finish readings, visual inspection signoff
- Non-conformances: Any NCR generated during production, with disposition and CAPA linkage
- Acceptance: Final release authorization by quality personnel
QMSR note: Under the new regulation, the "Device History Record" concept continues but aligns with ISO 13485 Clause 7.5.1 requirements for production records. The key difference: FDA inspectors now have broader access to review associated quality records including management review outputs and internal audit findings during inspections.
CAPA for Machining Non-Conformances
When a CNC-machined medical device part fails inspection, 21 CFR 820.90(a) requires investigation. But the FDA expects more than "operator error" — they want systematic root cause analysis that identifies the failure mechanism and prevents recurrence.
| NCR Type | Common Root Cause | Effective CAPA | Weak CAPA (FDA Red Flag) |
|---|---|---|---|
| Dimension out of tolerance | Tool wear beyond limit | Implement counter-based tool change + SPC monitoring | "Retrained operator" |
| Surface finish failure | Chatter from worn spindle bearing | Vibration monitoring + PM schedule update | "Will monitor closely" |
| Wrong material machined | Bar stock mix-up at saw | Material verification (PMI) before first cut | "Added note to SOP" |
| Burr on critical edge | Missing deburring step in routing | Add deburring as verified operation in traveler | "Operator will check" |
Frequently Asked Questions
When does a CNC machine need revalidation?
Revalidation (partial or full OQ/PQ) is required after: major repair (spindle replacement, ball screw change), CNC control software update, relocation of the machine, any modification that could affect positioning accuracy, or when SPC data shows a drift in process capability. Annual calibration checks (ISO 230 ball bar test) serve as ongoing verification but do not replace revalidation when triggered by a change.
Does every CNC program change require revalidation?
It depends on the change. Optimization-only changes (adjusting feed rate within the validated range) typically require a partial PQ — run 10–30 parts and verify dimensions and Cpk. Changes that affect geometry (new toolpath, new fixture, new tool) require a full PQ with 30+ parts. Document the rationale for the validation scope in a change control record.
What Cpk is required by FDA?
The FDA does not specify a minimum Cpk value — but the industry standard for medical devices is Cpk ≥ 1.33 (equivalent to 4σ). For life-sustaining or life-supporting devices, many companies target Cpk ≥ 1.67 (5σ). These values must be demonstrated during PQ and maintained during production. This requirement remains unchanged under the QMSR.
How does the QMSR transition affect my existing validated processes?
Existing validations performed under 21 CFR 820 remain valid — you do not need to revalidate processes solely because of the regulatory change. However, you must update your QMS documentation (validation protocols, SOPs, record templates) to align with ISO 13485:2016 terminology and structure. When your next revalidation trigger occurs (machine repair, software update, process change), the new validation protocol should follow QMSR/ISO 13485 format. Prioritize updating your risk management documentation, as the QMSR now explicitly requires risk-based thinking across the entire QMS, not just in design and development.
What should CNC shops do to prepare for FDA inspections under the new QMSR?
The FDA retired the QSIT (Quality System Inspection Technique) and replaced it with Compliance Program 7382.850, which follows ISO-style process auditing. Key differences: (1) inspectors will evaluate system effectiveness and process interactions, not just individual requirements; (2) internal audit reports and management review outputs are now subject to FDA review — previously these were exempt; (3) expect more emphasis on risk management documentation across all processes including supplier controls, manufacturing, and post-market activities.