Every medical device manufacturer I’ve worked with has a Quality Policy. It’s framed or it’s printed on a poster. It’s on a wall somewhere — near the breakroom, in the lobby, laminated above someone’s desk. It was written by a Quality professional, signed by a CEO somewhere between a lease agreement and an insurance form, and last revised during a previous decade.
Under the old QSR, that was basically fine. Section 820.20 required a Quality Policy and management review, and as long as you could produce both on demand, you had satisfied the letter of the regulation. Whether top management actually engaged with quality beyond an annual signature was something the old §820.180(c) exemption mostly kept between you and your ISO registrar.
The QMSR is a different environment. ISO 13485 Clause 5 — Management Responsibility — is now federal law by way of §820.7, and the §820.180(c) exemption is gone. That Quality Policy on the wall? FDA can now read it. The management review records behind it? Those too.
What Clause 5 Actually Requires
Clause 5 is organized into six subclauses, and while none of them will be shocking to anyone familiar with the old §820.20, the level of specificity is meaningfully different.
5.1 Management Commitment requires top management to provide evidence of its commitment to the QMS — by communicating the importance of meeting customer and regulatory requirements, establishing the quality policy, ensuring quality objectives are set, conducting management reviews, and ensuring resources are available. The word that matters here is evidence. Commitment as an attitude is not auditable; commitment as a documented pattern of behavior is.
5.2 Customer Focus is short but worth noticing. It requires top management to ensure that customer and applicable regulatory requirements are determined and met. Under the old QSR, “customer focus” wasn’t a named concept. ISO 13485 ties it explicitly to regulatory requirements — which means FDA is part of the “customer” universe your QMS must serve.
5.3 Quality Policy requires that the policy be appropriate to the purpose of the organization, include a commitment to comply with requirements and maintain QMS effectiveness, provide a framework for quality objectives, be communicated and understood throughout the organization, and be reviewed for continuing suitability. That last point — reviewed for continuing suitability — is the one that lamination does not satisfy.
5.4 Planning covers quality objectives (5.4.1) and QMS planning (5.4.2). Quality objectives must be measurable and consistent with the quality policy. “We are committed to quality” is not a measurable objective. “Reduce first-pass yield variance below X% by Q4” is. The old QSR had no explicit requirement for measurable objectives. ISO 13485 does.
5.5 Responsibility, Authority, and Communication requires defined responsibilities and authorities (5.5.1), an appointed management representative (5.5.2), and established internal communication processes (5.5.3).
5.6 Management Review is where most of the practical action — and most of the change from the old QSR — is concentrated. It defines specific required inputs (5.6.2) and outputs (5.6.3) your review must address.
What Changed From §820.20
The old §820.20 was four paragraphs long. It required a quality policy, organizational structure, adequate resources, a management representative, and management review at defined intervals. That was essentially it. The specifics — what the quality policy had to include, what a management review had to cover, how quality objectives worked — were left to the manufacturer’s interpretation.
Clause 5 is more directive on several fronts:
Quality objectives must be measurable. Under the old QSR, aspirational objectives were common. They won’t hold up under the QMSR if an investigator looks closely.
Management review inputs and outputs are specified. Under 5.6.2, review inputs must include feedback, complaint handling, reporting to regulatory authorities, audit results, process monitoring, product conformity, CAPA status, follow-up from previous reviews, changes affecting the QMS, recommendations for improvement, and applicable new or revised regulatory requirements. That last one is worth calling out — your next management review is, in fact, supposed to address the QMSR itself. Outputs (5.6.3) must include decisions and actions on QMS improvement, product improvement, regulatory changes, and resource needs. A management review record that is a list of attendees and a note that quality objectives were discussed is not going to hold up.
The management representative has a specified role. Under 5.5.2, the representative must ensure QMS processes are documented, report on QMS performance to top management, and ensure awareness of regulatory and customer requirements throughout the organization. This is a member of management with authority to act — not a junior designee in a corner office.
The Records Are Now Visible
As we covered in the Clause 4.2 post, the old §820.180(c) exemption that kept management review records out of FDA’s inspection reach is gone. Your review minutes, documented inputs, and the decisions coming out of those reviews are now potentially within scope of a Form 483.
This is not a reason to document less. It’s a reason to make sure what you document reflects what’s actually happening. A management review that engages with quality data, identifies real issues, and produces real actions is an asset. A review that exists only as a signed attendance sheet is now a liability in a way it wasn’t before.
What to Do This Quarter
A short list of things worth looking at before your next management review: pull your quality policy and read it critically — does it commit to compliance with regulatory requirements, does it frame your objectives, is it actually reviewed for continuing suitability? Check your quality objectives against 5.4.1’s measurability requirement — if any of them sound like a motivational poster, they need rework. Review your management review template against the inputs and outputs in 5.6.2 and 5.6.3. And confirm your management representative’s role is formally documented and carries the authority the role requires.
None of this is dramatic. Most of it is housekeeping. But Clause 5 is where the QMSR asks whether your leadership is visibly committed to quality — not in spirit, but on paper — and the paper is now available to FDA.
If the Quality Policy on your wall is older than your last CAPA, this is a reasonable week to take it down and read it.