Most teams building toward the EU, the US and Singapore run three quality systems. One for the notified body, one for the FDA, one for HSA — three sets of procedures, three internal audits, three change-control logs, all describing the same company doing the same work in slightly different dialects. It feels like diligence. It is mostly duplication, and it is quietly expensive: every change now has to be made three times, and every gap between the three copies is an audit finding waiting to happen.
The contrarian position — and, since February 2026, the correct one — is that you do not need three quality systems. You need one, built on ISO 13485, with market-specific annexes bolted to the edges. The regulators have spent the last two years moving toward each other, and the single-system approach is now not just cheaper but better supported by the rules than the three-system habit it replaces.
What changed: the US moved onto ISO 13485
The reason a single system is now realistic is that the biggest outlier closed the gap. On 2 February 2026 the FDA's Quality Management System Regulation (QMSR) took effect, replacing the old Quality System Regulation and aligning 21 CFR Part 820 with ISO 13485:2016 by incorporation-by-reference. In plain terms: the US no longer runs a bespoke quality framework that only overlaps with the international standard. It is the international standard, with a thin layer of US-specific additions on top.
| Regulator | Quality baseline | Effect on a single-system approach |
|---|---|---|
| FDA — QMSR | 21 CFR Part 820 now incorporates ISO 13485:2016 (effective 2 Feb 2026) | The US baseline is now ISO 13485. An existing ISO 13485 system is much closer to compliant than it was under the old QSR — the remaining US content is additive, not a parallel structure. |
| EU — MDR/IVDR | ISO 13485 in practice, via Article 10 QMS obligations and MDCG guidance | Already the anchor. MDCG 2025-6 pushes explicitly toward one QMS, one file, one conformity assessment. |
| Singapore — HSA | GL-04 and HSA registration built on the same ISO 13485 quality logic | Recognises the same foundation and gives credit for prior approvals through reliance routes. |
The strategic reading is straightforward: if all three regulators now assess you against a system rooted in the same standard, maintaining three separate systems is no longer prudence. It is waste.
The EU already told you to consolidate
The clearest statement of the single-system principle does not come from a quality standard at all — it comes from the guidance the EU issued for medical AI. MDCG 2025-6 sets out an integrated approach: one quality management system, one technical documentation file, one conformity assessment via the MDR/IVDR route. Not two compliance programmes bolted together; one, with the AI-specific obligations folded into the existing device framework.
That principle generalises. The logic MDCG applied to AI-plus-device — do not run parallel programmes for the same product — is the logic that should govern your whole quality architecture across markets. If the EU expects one system to carry both the device and its AI obligations, a company running three systems for three geographies is working against the grain of where regulation is heading. We unpacked how that integrated route works for AIaMD in The EU AI Act meets MDR.
The single QMS is the operational twin of the single dossier. We wrote in One dossier, three markets about building one technical file that answers all three regulators. This is the machine underneath that file: the quality system that produces, controls and maintains the evidence the dossier is made of. Get the system right and the dossier writes itself; get it wrong and you are reconciling three versions of the truth forever.
Where the three still diverge — and why annexes, not systems, are the answer
Convergence is not the same as identity. The three regulators still ask for different things at the edges, and pretending they don't is how a single-system project fails. The trick is to isolate the differences into market-specific annexes that hang off a shared ISO 13485 core, rather than letting them fork the whole system.
| QMS element | MDR / IVDR (EU) | FDA QMSR (US) | HSA (Singapore) |
|---|---|---|---|
| Records structure | Technical documentation per Annexes II/III; device-by-device file | Device master record vocabulary retained on top of ISO 13485; specific US labelling and UDI records | GL-04 submission dossier; accepts ISO 13485 evidence and prior-approval material |
| Design controls | Design & development file under ISO 13485 clause 7.3, plus MDR clinical evaluation | Same clause 7.3, plus retained US expectations on design history | Same clause 7.3; leans on the reference regulator's assessment under reliance |
| Change management | Change-control and, for AI, a predetermined change control plan under MDR | PCCP for AI-enabled device software functions; QMSR change controls | GL-04 streamlined change-management pathway for software changes |
| Post-market | PMS and PMCF plans, vigilance reporting, PSUR | Complaint handling, MDR (medical device reporting), correction/removal rules | HSA post-market duties; field-safety and adverse-event reporting |
| Route to approval | Notified-body conformity assessment | 510(k)/De Novo/PMA as applicable | Full or abridged evaluation via reliance on a prior approval |
Read down the columns and the pattern is obvious: the spine is identical — design controls, risk management, change control, post-market surveillance, all ISO 13485. The divergence sits in vocabulary and packaging. The US keeps its device master record language and its own reporting rules. The EU wants technical documentation assembled its way. HSA cares less about a fat local file and more about which regulator cleared you first, because reliance lets it give credit for that work. None of these differences justifies a second or third quality system. They justify annexes.
How to structure the one system
The pattern that works: a single ISO 13485 core — the procedures, the quality manual, the shared processes for design, risk, CAPA, supplier control and post-market — plus a short, controlled set of market annexes that capture only what is genuinely local. A US annex that maps the QMSR additions and device master record vocabulary onto the core. An EU annex covering MDR technical-documentation structure, clinical evaluation and PMS/PMCF. A Singapore annex covering the GL-04 dossier and the reliance route you intend to use.
Built this way, a process change is made once in the core and inherited everywhere. Only genuinely jurisdiction-specific changes touch an annex. Your internal audit checks one system against three overlays, not three systems against each other. And when a notified body, an FDA investigator and an HSA reviewer each turn up, they are all looking at the same spine — which is exactly the coherence each of them is trained to reward.
The one-line version: since the QMSR took effect on 2 February 2026, all three regulators assess you against a system rooted in ISO 13485 — so build one core quality system and bolt market-specific annexes to the edges, rather than running three systems that describe the same company three times.
What to do this quarter
01 · Anchor everything to ISO 13485
If your quality system is not already built on ISO 13485:2016, make that the spine now. Post-QMSR, it is the shared baseline the US, EU and Singapore all assess against.
02 · Separate the core from the annexes
Audit your existing procedures and sort every requirement into "shared spine" or "market-specific." Only the genuinely local content — QMSR records, MDR technical documentation, GL-04 dossier — belongs in an annex.
03 · Write change control once
Build one change-management process that maps to the FDA PCCP, the MDR change-control plan and GL-04's streamlined software pathway. The discipline is identical; only the paperwork differs.
04 · Retire the duplicate systems
Every parallel procedure is a future audit finding where the copies drift apart. Consolidate onto the single core so a change is made once and inherited everywhere.
Sources & further reading
- Meridian 103.8 — One dossier, three markets: harmonising your regulatory submission across the EU, US and Singapore.
- Meridian 103.8 — The EU AI Act meets MDR: the integrated route for AI as a medical device.
- HSA — Digital Health / Software Medical Devices (GL-04).
- Meridian 103.8 — more regulatory and quality insights.
This article is general information current as at 13 October 2026, not regulatory or legal advice. Quality-system requirements and guidance change; confirm the current QMSR, MDR/IVDR and HSA position for your specific device and quality system before acting.