FDA QMSR Is Effective: 8 Questions to Ask a Patch OEM

FDA’s Quality Management System Regulation (QMSR) became effective on 2 February 2026. It incorporates ISO 13485:2016 by reference and adds FDA-specific provisions. For patch buyers, the practical test is not whether an OEM can show a certificate; it is whether records connect product risk, production controls, complaints and corrective action.

Scope matters. QMSR applies to finished medical-device manufacturers covered by FDA’s device current good manufacturing practice requirements. A patch marketed as a drug, cosmetic or general wellness product can fall under a different framework. Settle classification and intended claims first.

1. “Which of our products are actually inside your QMSR scope?”

A useful answer names the product type, intended use and the legal manufacturer. A weak answer is “our factory is FDA registered, so everything is FDA approved.” Registration, listing, clearance, approval and quality-system compliance are different concepts.

Ask the supplier to show how it decides which controls apply when the same production site handles several categories. The boundary should cover incoming materials, shared equipment, labelling, release and outsourced steps. If nobody owns that boundary, records tend to split at the exact point where a complaint needs to be investigated.

2. “Show us where product risk changes a manufacturing control.”

The final QMSR text requires one or more documented processes for risk management in product realisation and records of those activities. That makes risk management more than a document prepared at the end of development.

For an adhesive patch, ask for one worked example. A risk of edge lift might affect adhesive coat weight, liner release, pouch choice, application instructions and final inspection. The supplier should be able to trace the risk into controls and back to evidence. A generic risk table with no production link is not enough.

3. “What changed between the approved sample and today’s production?”

Give the OEM a real lot number. Ask it to identify the approved bill of materials, specification revision, artwork version, batch record and release status for that lot. Then ask how a backing-film, adhesive, pouch or printing change would be reviewed before use.

This question often reveals more than a prepared audit presentation. Private-label products are vulnerable to quiet substitutions when lead times tighten. The buyer needs a written notification threshold and an approval path for changes that can affect skin contact, adhesion, stability or claims.

4. “How do you qualify and monitor the suppliers behind the patch?”

A patch is a small product with a long supply chain. The matrix, nonwoven, backing film, release liner, pouch, ink and carton may come from different sources. Ask which materials are critical, how suppliers are approved, what incoming checks are performed and what happens after an out-of-specification result.

Do not ask only for a vendor list. Pick one critical component and follow it from purchase specification to receiving record, test result, warehouse status and production issue.

5. “When does a complaint become an investigation?”

The QMSR final rule ties complaint handling to ISO 13485 and FDA-specific section 820.35. FDA’s discussion states that the rule describes when a complaint investigation must begin and when related records must be kept.

Use a realistic scenario: a customer reports skin irritation, early detachment or a pouch that was open on arrival. Ask who records it, who assesses reportability, how retained samples and batch history are checked, and how the outcome reaches the customer. Also ask how the firm documents a decision not to investigate.

6. “Can you connect nonconformity, correction and preventive action?”

Start with a recent, anonymised deviation rather than a polished procedure. The record should show containment, disposition, root-cause work where appropriate, action, effectiveness review and any broader impact on released lots or other products.

One failed seal is not automatically a systemic corrective-action project. Repeated seal failures with the same pattern should not be closed as unrelated operator errors either. The quality system needs a way to see recurrence.

7. “Which records could FDA inspect, and how quickly can you retrieve them?”

FDA states that its focus is on whether the substance of record and approval requirements is met, not whether the record or signature is physical. Electronic records still need control, traceability and retrieval.

During supplier selection, request a timed trace. Choose a batch and ask for the production record, material status, inspection data, deviations and release approval. The exercise does not need confidential formulas. It does need to show that records are complete and can be found without reconstructing the story from memory.

8. “What does your certificate not cover?”

An ISO 13485 certificate can be useful evidence, but read the scope, site address, covered activities and expiry date. It does not by itself prove that a particular patch is cleared, approved or manufactured in compliance with every FDA requirement.

Ask who issues the certificate, which site it covers and whether the proposed work sits inside the certified scope. Then assess the product records. Certificate review and product due diligence are separate jobs.

A compact buyer scorecard

For regulated patch projects, Henan Hanmeng Bio-Tech and the brand owner should agree in writing who controls specifications, changes, complaint exchange and regulatory records. The agreement should match the actual product classification rather than reuse a generic template.

Source

• FDA final rule: Medical Devices; Quality System Regulation Amendments, published 2 February 2024 and effective 2 February 2026.
• Official Federal Register PDF of the QMSR final rule.