Skip to content
Hybrid GraphRAG Wiki & Architecture

FDA QMSR & ISO 13485:2016 Alignment

The QMSR Transition

Effective February 2, 2026, the United States Food and Drug Administration (FDA) amended 21 CFR Part 820 to directly incorporate the international standard ISO 13485:2016 by reference, establishing the Quality Management System Regulation (QMSR).

The platform architecture incorporates the core operational mandates of the QMSR:

1. Medical Device File (MDF - Clause 4.2.3) Integration

  • The Regulatory Shift: The legacy 1996 QSR fragmented design and manufacturing data across separate binders: Design History Files (DHF - § 820.30), Device Master Records (DMR - § 820.181), and Device History Records (DHR - § 820.184). Under ISO 13485 Clause 4.2.3, organizations must maintain an interconnected Medical Device File.
  • Graph Representation: In Memgraph and PostgreSQL, :MedicalDeviceFile nodes unite these silos into an interconnected operational evidence graph:
    • (:MedicalDeviceFile)-[:GOVERNS_DEVICE_SYSTEM]->(:System)
    • (:MedicalDeviceFile)-[:OPERATED_UNDER_SOP]->(:SOP)
    • (:MedicalDeviceFile)-[:SPECIFIED_BY_REQUIREMENT]->(:Requirement)

2. FDA CP 7382.850 & Inspectable Audits

  • Removal of the Audit Shield: Legacy 21 CFR § 820.180(c) prevented FDA investigators from reviewing internal audit findings and management reviews. Under QMSR, internal audits (Clause 8.2.4) and management reviews (Clause 5.6) are fully inspectable.
  • Cross-Process Audit Scrutiny: Under Compliance Program Guidance CP 7382.850, investigators audit cross-process compliance across purchasing, production, CAPA, and management oversight.
  • AuditInspectionReadinessAgent: Continuously traverses cross-process linkages in the knowledge graph to detect deficiencies before external regulatory inspections.

3. Foundation Model Governance & Purchasing Controls (Clause 7.4)

  • Active Supplier Monitoring: Clause 7.4 mandates risk-based supplier controls. Third-party cloud AI models cannot be treated as unmonitored black boxes.
  • Enforced Model Determinism: Foundation models are locked to immutable snapshot identifiers (deepseek-v4-flash-20260202), temperature is locked to $0.0$, and zero data retention guarantees are verified.
  • VendorAssessmentCsaAgent: Evaluates model deprecation schedules (requiring minimum 30-day advance notice) and verifies ISO/IEC 42001 AI governance certifications.

4. Bifurcated Remediation: Corrective (8.5.2) vs Preventive (8.5.3) Actions

  • Corrective Action (Clause 8.5.2): Eliminates the root cause of an existing nonconformity or defect to prevent recurrence.
  • Preventive Action (Clause 8.5.3): Proactively eliminates the causes of potential nonconformities in order to prevent their occurrence, driven by risk analysis (ISO 14971) and trend telemetry.
  • CapaChangeControlAgent: Strictly categorizes quality remediation actions into Corrective or Preventive categories and verifies that actions do not introduce adverse effects.