If you’ve spent any time in medical device quality, you have a mental filing cabinet with three very specific drawers labeled DMR, DHR, and DHF. You know what goes in each one. You’ve probably defended each one to an FDA investigator at some point. You may have spent a meaningful portion of your career maintaining the distinction between them.
Here’s the news: under ISO 13485:2016 — now incorporated by reference into 21 CFR Part 820, as we covered in the §820.7 post — those three drawers get a new label: the Medical Device File. And buried in the same section is a change to what FDA can ask to see during an inspection that is worth your full attention.
Welcome to ISO 13485 Clause 4.2, Documentation Requirements. It looks administrative on the surface. It is not entirely administrative on the surface.
What Clause 4.2 Actually Covers
Clause 4.2 is the documentation backbone of your QMS. It has five subclauses:
4.2.1 General sets the documentation hierarchy: your QMS must be supported by a quality policy, measurable quality objectives, a quality manual, documented procedures, records, and any other documents necessary for effective planning, operation, and control of your processes. This is similar in spirit to what the old QSR required, but the framing is more explicit. If a document is necessary for your QMS to function, it needs to exist and be controlled.
4.2.2 Quality Manual requires a documented quality manual that describes the scope of your QMS, justifies any exclusions, references or includes your procedures, describes how your processes interact, and outlines your documentation structure. This replaces the old QSR’s Quality System Record requirement at §820.186. The quality manual isn’t a new concept — most manufacturers already had one — but ISO 13485 is specific about what it must contain, and the requirement to describe process interactions and document structure is worth reviewing against what you have on file.
4.2.3 Medical Device File is where the acronym reshuffling happens, and we’ll spend more time here in a moment.
4.2.4 Document Control mirrors what old §820.40 required: documents must be approved before use, reviewed and updated as needed, with changes identified and revision history maintained. Relevant versions must be available where they’re needed. Obsolete documents must be pulled from use (and identified as obsolete if retained for reference). External-origin documents — standards, regulatory guidance, customer specifications — must be identified and controlled. If your document control procedure already addressed these elements under the old QSR, you’re in good shape; the requirements are substantively similar.
4.2.5 Control of Records requires that records remain legible, identifiable, and retrievable. Retention periods must be defined — with the ISO 13485 baseline being at least the lifetime of the device as defined by the organization, or a minimum of two years from date of product release, whichever is longer. Records must be protected from deterioration and unauthorized access.
The Medical Device File: Three Acronyms, One Container
The Medical Device File (MDF) is the ISO 13485 term for the master repository of documentation associated with a specific device or device family. Under Clause 4.2.3, each device or device family must have an MDF that contains — or provides references to — the specifications, production requirements, labeling, and quality controls applicable to that device.
If that sounds familiar, it should. The MDF is conceptually the heir to three familiar QSR constructs:
The Device Master Record (DMR) under old §820.181 contained the device specifications, production procedures, quality requirements, packaging and labeling specifications, and installation procedures. The DMR was the blueprint — the full picture of what the device is and how it’s made.
The Device History Record (DHR) under old §820.184 was the production evidence file — batch records, acceptance records, equipment logs, the documented proof that each unit was actually made according to the DMR.
The Design History File (DHF) under old §820.30(j) documented the design controls history — evidence that design and development was conducted in accordance with the approved design plan.
Under ISO 13485, these concepts survive — the requirements for device specifications, production records, and design documentation are all still there — but the discrete naming convention is gone. FDA has confirmed that if your content meets the underlying requirements, the organizational structure you use is up to you. You do not need to tear down your DMR/DHR/DHF architecture to be compliant, as long as the MDF concept is satisfied: all required documentation exists, is controlled, and is accessible.
That said, if your current documentation structure has gaps — design records that were never properly closed out, production records that don’t clearly tie back to specifications — the QMSR is a reasonable prompt to address them. The MDF framework rewards documentation that tells a coherent device story from design through production through post-market. If yours doesn’t quite do that yet, now is a reasonable time to notice.
The Change That Deserves Its Own Paragraph
Under the old QSR, §820.180(c) included a specific exemption: FDA investigators could not access management review records, quality audit reports, and supplier audit reports during inspections. This exemption was not universally loved by industry (it created some awkward documentation gymnastics), but it provided a meaningful boundary around certain internal quality records.
That exemption does not exist in the QMSR.
As we touched on in the outsourcing post, your supplier audit reports are now available for FDA review. So are your internal audit records and management review records. The full scope of your documented QMS activity — including the records that used to be shielded — is now in scope for a Form 483 observation.
What this means practically: the quality of your internal audit documentation now matters to FDA, not just to your registrar. An audit program that finds nothing, ever, will look as curious to an FDA investigator as it would to a notified body. Audit findings that were documented but never addressed will also be visible. Management review records that are perfunctory — a list of attendees and a checkbox confirming that quality objectives were discussed — may prompt follow-up questions.
This is not a reason to stop documenting things honestly. It is a reason to ensure your internal documentation reflects a QMS that is actually functioning: audits that find things, corrective actions that are followed through, management reviews that engage with real data. The §820.180(c) exemption meant you could have that quality without FDA knowing. Now FDA can know, which means the quality matters in a more immediately visible way.
What You Should Actually Do
A few practical steps worth taking if you haven’t already:
Review your quality manual against Clause 4.2.2. Does it describe your scope accurately? Does it describe how your processes interact? If it was written to satisfy §820.186 and hasn’t been updated since, it likely needs revision.
Map your existing DMR, DHR, and DHF to the MDF concept. You don’t need to rename them. You do need to confirm that the collective set of documents meets the MDF content requirements — that nothing required by ISO 13485 is missing or inaccessible.
Review your document retention policy against ISO 13485’s minimums. Two years from product release, or the defined lifetime of the device, whichever is longer. If your policy is more conservative than that, fine. If there are gaps, address them.
Take a hard look at your audit program documentation with the assumption that an FDA investigator could ask for it. Not to sanitize it — but to make sure it accurately reflects the work you’re doing and that the follow-through on findings is documented.
The Bottom Line
ISO 13485 Clause 4.2 is not a dramatic departure from what good quality documentation practice looked like under the old QSR. The quality manual is still there. Document control is still there. Record retention is still there. The substance of the DMR, DHR, and DHF is still there, wearing a new hat.
What’s changed is one significant boundary: the wall between your internal quality records and FDA’s inspection reach. If your internal quality program is genuinely functioning — if your audits are real, your CAPAs are followed through, your management reviews engage with actual data — that change costs you nothing. If it isn’t, this is a good year to make it so.
The QMSR is now in effect. Your documentation tells the story of how seriously you take that.
Work with Red Hen Admin
Ready to put this into practice?
Whether you need an independent quality system audit or hands-on QMS consulting, Red Hen Admin can help — remote and on-site in Southern California.